CVE-2021-25746 Ingress-nginx directive injection via annotations
Users with ingress creation rights can inject annotations to steal controller credentials, granting access to all cluster secrets.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-25746?
CVE-2021-25746 is a high-severity missing authorization vulnerability in Kubernetes ingress-nginx, published on 6 May 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use .metadata.annotations in an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.
Weakness: CWE-20
Which versions are affected by CVE-2021-25746?
It affects 1 product.
Products include Kubernetes Ingress-Nginx.
How do I fix CVE-2021-25746?
No fix has been published for CVE-2021-25746 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-25746 being exploited?
There is no known exploitation of CVE-2021-25746 in the wild and no public exploit code.
Other vulnerabilities in Kubernetes ingress-nginx
- CVE-2026-3288 ingress-nginx rewrite-target nginx configuration injection
- CVE-2022-4886 Ingress-nginx `path` sanitization can be bypassed with `log_format` directive
- CVE-2023-5043 Ingress nginx annotation injection causes arbitrary command execution
- CVE-2023-5044 Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation
- CVE-2021-25748 Ingress-nginx `path` sanitization can be bypassed with newline character
Sources
Also known as GHSA-79xv-4hmm-pw72.