CVE-2021-25748 Ingress-nginx `path` sanitization can be bypassed with newline character

What is CVE-2021-25748?

CVE-2021-25748 is a high-severity vulnerability in Kubernetes ingress-nginx, published on 24 May 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the sanitization of the `spec.rules[].http.paths[].path` field of an Ingress object (in the `networking.k8s.io` or `extensions` API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.

Weakness: CWE-20

Which versions are affected by CVE-2021-25748?

2 open source packages ship an affected version, including k8s.io/ingress-nginx. It affects 1 product.

Products include Kubernetes Ingress-Nginx.

How do I fix CVE-2021-25748?

Upgrade k8s.io/ingress-nginx to 1.2.1 or later.

Is CVE-2021-25748 being exploited?

There is no known exploitation of CVE-2021-25748 in the wild and no public exploit code.

Other vulnerabilities in Kubernetes ingress-nginx

• CVE-2026-3288 ingress-nginx rewrite-target nginx configuration injection High 8.8
• CVE-2022-4886 Ingress-nginx `path` sanitization can be bypassed with `log_format` directive High 8.8
• CVE-2023-5043 Ingress nginx annotation injection causes arbitrary command execution High 7.6
• CVE-2023-5044 Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation High 7.6
• CVE-2021-25745 Ingress-nginx path can be pointed to service account token file High 7.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-863x-868h-968x.