Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
16 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go k8s.io/ingress-nginx < 0.0.0-20260319175635-5183b7d86137
Fixed in
0.0.0-20260319175635-5183b7d86137· Vendor fix available
Issue
A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Recommended action: Upgrade to 0.0.0-20260319175635-5183b7d86137 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go k8s.io/ingress-nginx < 1.13.7; >= 1.14.0, < 1.14.3
Fixed in
1.14.31.13.7· Vendor fix available
Issue
A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/auth-method Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Recommended action: Upgrade to 1.14.3 or 1.13.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go k8s.io/ingress-nginx < 1.13.7; >= 1.14.0, < 1.14.3
Fixed in
1.14.31.13.7· Vendor fix available
Issue
A security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a denial of service condition. By sending large requests to the validating admission controller, an attacker can cause memory consumption, which may result in the ingress-nginx controller pod being killed or the node running out of memory.
Recommended action: Upgrade to 1.14.3 or 1.13.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go k8s.io/ingress-nginx < 1.13.7; >= 1.14.0, < 1.14.3
Fixed in
1.14.31.13.7· Vendor fix available
Issue
A security issue was discovered in ingress-nginx. Tthe rules.http.paths.path Ingress field can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Recommended action: Upgrade to 1.14.3 or 1.13.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go k8s.io/ingress-nginx < 1.13.7; >= 1.14.0, < 1.14.3
Fixed in
1.14.31.13.7· Vendor fix available
Issue
A security issue was discovered in ingress-nginx where the protection afforded by the auth-url Ingress annotation may not be effective in the presence of a specific misconfiguration. If the ingress-nginx controller is configured with a default custom-errors configuration that includes HTTP errors 401 or 403, and if the configured default custom-errors backend is defective and fails to respect the X-Code HTTP header, then an Ingress with the auth-url annotation may be accessed even when authentication fails. Note that the built-in custom-errors backend works correctly. Triggering this issue requires an administrator to specifically configure ingress-nginx with a broken external component.
Recommended action: Upgrade to 1.14.3 or 1.13.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go k8s.io/ingress-nginx < 1.11.5; >= 1.12.0-beta.0, < 1.12.1
Fixed in
1.11.51.12.1· Vendor fix available
Issue
A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Recommended action: Upgrade to 1.12.1 or 1.11.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go k8s.io/ingress-nginx < 1.11.5; >= 1.12.0-beta.0, < 1.12.1
Fixed in
1.11.51.12.1· Vendor fix available
Issue
A security issue was discovered in ingress-nginx where the mirror-target and mirror-host Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Recommended action: Upgrade to 1.12.1 or 1.11.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go k8s.io/ingress-nginx < 1.11.5; >= 1.12.0-beta.0, < 1.12.1
Fixed in
1.11.51.12.1· Vendor fix available
Issue
A security issue was discovered in ingress-nginx where the auth-url Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Recommended action: Upgrade to 1.12.1 or 1.11.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go k8s.io/ingress-nginx < 1.11.5; >= 1.12.0-beta.0, < 1.12.1
Fixed in
1.11.51.12.1· Vendor fix available
Issue
A security issue was discovered in ingress-nginx where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.
Recommended action: Upgrade to 1.12.1 or 1.11.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go k8s.io/ingress-nginx < 1.11.5; >= 1.12.0-beta.0, < 1.12.1
Fixed in
1.11.51.12.1· Vendor fix available
Issue
A security issue was discovered in ingress-nginx where the auth-tls-match-cn Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Recommended action: Upgrade to 1.12.1 or 1.11.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A security issue was identified in ingress-nginx where the nginx.ingress.kubernetes.io/permanent-redirect annotation on an Ingress object (in the networking.k8s.io or extensions API group) can be used to inject arbitrary commands, and obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.
Recommended action: Upgrade to 1.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Issue Details A security issue was identified in ingress-nginx where the nginx.ingress.kubernetes.io/configuration-snippet annotation on an Ingress object (in the networking.k8s.io or extensions API group) can be used to inject arbitrary commands, and obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster. This issue has been rated High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L), and assigned CVE-2023-5043. Affected Components and Configurations This bug affects ingress-nginx. If you do not have ingress-nginx installed on your cluster, you are not affected. You can check this by running kubectl get po -n ingress-nginx. If you are running the “chrooted” ingress-nginx controller introduced in v1.2.0 (gcr.io/k8s-staging-ingress-nginx/controller-chroot), command execution is possible but credential extraction is not, so the High severity does not apply. Multi-tenant environments where non-admin…
Recommended action: Upgrade to 1.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Ingress-nginx path sanitization can be bypassed with logformat directive.
Recommended action: Upgrade to 1.8.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the sanitization of the spec.rules[].http.paths[].path field of an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.
Recommended action: Upgrade to 1.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyphenated namespace or secret name.
Recommended action: Upgrade to 0.28.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.
Recommended action: Upgrade to 1.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.