CVE-2021-25746: Improper Input Validation

May 6, 2022 (updated December 2, 2022)

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use .metadata.annotations in an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.

References

github.com/kubernetes/ingress-nginx/issues/8503
groups.google.com/g/kubernetes-security-announce/c/hv2-SfdqcfQ
nvd.nist.gov/vuln/detail/CVE-2021-25746

Code Behaviors & Features

Detect and mitigate CVE-2021-25746 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →