Database/Container, Kubernetes & orchestration
ingress-nginx: Custom nginx snippets in an Ingress annotation retrieve the ingress-nginx service-account token
CVE-2021-25742Container, Kubernetes & orchestrationcurated
Impact
Custom nginx snippets in an Ingress annotation retrieve the ingress-nginx service-account token and therefore every Secret in the cluster
Who can reach it
Cluster user with namespace access who can create Ingress objects
What to do
Rolling controller upgrade and set allow-snippet-annotations: false; rotate all cluster Secrets if exploited
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.