CVE-2024-7646
A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `extensions` API group) can bypass annot…
Published: 2024-08-16 · CVSS: 8.8 · CVSS 3.1
A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `extensions` API group) can bypass annotation validation to inject arbitrary commands and obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7