CVE-2021-25742 Ingress-nginx custom snippets allows retrieval of ingress-nginx serviceaccount token and secrets across all namespaces
Users with ingress creation rights can exploit custom snippets to read all cluster secrets, requiring ingress-nginx updates.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-25742?
CVE-2021-25742 is a high-severity missing authorization vulnerability in Kubernetes ingress-nginx, published on 29 Oct 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster.
Weakness: CWE-20
Which versions are affected by CVE-2021-25742?
It affects 2 products.
Linux distribution packages (1)
rke openSUSE:Tumbleweed | All versions | 1.3.3-1.1 |
Products include Kubernetes Ingress-Nginx, Netapp Trident.
How do I fix CVE-2021-25742?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-25742 being exploited?
There is no known exploitation of CVE-2021-25742 in the wild and no public exploit code.
Other vulnerabilities in Kubernetes ingress-nginx
- CVE-2026-3288 ingress-nginx rewrite-target nginx configuration injection
- CVE-2022-4886 Ingress-nginx `path` sanitization can be bypassed with `log_format` directive
- CVE-2023-5043 Ingress nginx annotation injection causes arbitrary command execution
- CVE-2023-5044 Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation
- CVE-2021-25748 Ingress-nginx `path` sanitization can be bypassed with newline character
Sources
Also known as GHSA-4pp2-3663-mcw8, openSUSE-SU-2024:11726-1.