CVE-2021-25745 Ingress-nginx path can be pointed to service account token file

What is CVE-2021-25745?

CVE-2021-25745 is a high-severity vulnerability in Kubernetes ingress-nginx, published on 6 May 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.

Weakness: CWE-20

Which versions are affected by CVE-2021-25745?

2 open source packages ship an affected version, including k8s.io/ingress-nginx. It affects 1 product.

Products include Kubernetes Ingress-Nginx.

How do I fix CVE-2021-25745?

Upgrade k8s.io/ingress-nginx to 1.2.0 or later.

Is CVE-2021-25745 being exploited?

There is no known exploitation of CVE-2021-25745 in the wild and no public exploit code.

Other vulnerabilities in Kubernetes ingress-nginx

• CVE-2026-3288 ingress-nginx rewrite-target nginx configuration injection High 8.8
• CVE-2022-4886 Ingress-nginx `path` sanitization can be bypassed with `log_format` directive High 8.8
• CVE-2023-5043 Ingress nginx annotation injection causes arbitrary command execution High 7.6
• CVE-2023-5044 Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation High 7.6
• CVE-2021-25748 Ingress-nginx `path` sanitization can be bypassed with newline character High 7.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pvmg-xgmx-9mxh, openSUSE-SU-2024:12031-1.