kubernetes nginx ingress controller vulnerabilities and exploits

(subscribe to this query)

Versions < 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly.

Kubernetes Nginx Ingress Controller

Ingress-nginx `path` sanitization can be bypassed with `log_format` directive.

Kubernetes Ingress-nginx

1 Article

Ingress nginx annotation injection causes arbitrary command execution.

Kubernetes Ingress-nginx

1 Github repository1 Article

Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation.

Kubernetes Ingress-nginx

3 Github repositories1 Article

A security issue exists in ingress-nginx where a user that can create or update ingress objects can use .metadata.annotations in an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configur...

Kubernetes Ingress-nginx

A security issue exists in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In t...

Kubernetes Ingress-nginx

A security issue exists in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the sanitization of the `spec.rules[].http.paths[].path` field of an Ingress object (in the `networking.k8s.io` or `extensions` API group) to obta...

Kubernetes Ingress-nginx

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook