CVE-2020-8553 Kubernetes ingress-nginx Compromise of auth via subset/superset namespace names
Attackers with namespace creation rights can overwrite basic auth files in other namespaces, leading to privilege escalation and unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-8553?
CVE-2020-8553 is a medium-severity missing authorization vulnerability in Kubernetes ingress-nginx, published on 29 Jul 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyphenated namespace or secret name.
Which versions are affected by CVE-2020-8553?
2 open source packages ship an affected version, including k8s.io/ingress-nginx. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
k8s.io/ingress-nginx Go | All versions | 0.28.0 |
k8s.io/ingress-nginx Go | All versions | 0.28.0 |
Products include Kubernetes Ingress-Nginx.
How do I fix CVE-2020-8553?
Upgrade k8s.io/ingress-nginx to 0.28.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-8553 being exploited?
There is no known exploitation of CVE-2020-8553 in the wild and no public exploit code.
Other vulnerabilities in Kubernetes ingress-nginx
- CVE-2026-3288 ingress-nginx rewrite-target nginx configuration injection
- CVE-2022-4886 Ingress-nginx `path` sanitization can be bypassed with `log_format` directive
- CVE-2023-5043 Ingress nginx annotation injection causes arbitrary command execution
- CVE-2023-5044 Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation
- CVE-2021-25748 Ingress-nginx `path` sanitization can be bypassed with newline character
Sources
Also known as GHSA-hhpm-74pm-hf35.