A security issue was discovered in ingress-nginx before versions 1.0.1 and 0.49.1 where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster. This issue cannot be fixed solely by upgrading ingress-nginx. To mitigate, set allow-snippet-annotations to false in your ingress-nginx ConfigMap based on how you deploy ingress-nginx, see the references for more information.
A security issue was discovered in ingress-nginx before versions 1.0.1 and 0.49.1 where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster. This issue cannot be fixed solely by upgrading ingress-nginx. To mitigate, set allow-snippet-annotations to false in your ingress-nginx ConfigMap based on how you deploy ingress-nginx, see the references for more information.
https://github.com/kubernetes/ingress-nginx/issues/7837 https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#allow-snippet-annotations https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/ https://github.com/kubernetes/ingress-nginx/pull/7670 https://github.com/kubernetes/ingress-nginx/commit/4fc57dcc4969cd907c6eeadffbba2d14949db39e