ingress-nginx Nginx Configuration Injection Vulnerability Leading to Code Execution and Secret Disclosure

A vulnerability exists in ingress-nginx versions prior to 1.13.9, 1.14.5, and 1.15.1. It allows the injection of Nginx configuration through specific Ingress annotations. This injection can result in arbitrary code execution within the ingress-nginx controller and the unauthorized disclosure of Secrets that the controller can access. By default, the ingress-nginx controller has access to all Secrets across the cluster.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution in the context of the ingress-nginx controller and the unauthorized disclosure of cluster-wide Secrets accessible to the controller.

Remediation

Users can upgrade to ingress-nginx versions 1.13.9, 1.14.5, or 1.15.1. Release builds for these versions are available from the usual distribution channels.