A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
The vulnerability affects the ingress-nginx controller running in a Kubernetes cluster. Under certain conditions, an attacker without any authentication but with access to the pod network can trigger arbitrary code execution (RCE) in the context of the controller process. This results from improper permission isolation (CWE-653 — Insufficient Compartmentalization), which allows breaking beyond the expected execution boundaries.
An attacker can execute arbitrary code in the context of the ingress-nginx controller and gain access to Kubernetes Secrets available to the controller — in the default configuration, this includes all Secrets across the entire cluster, which can lead to complete cluster takeover.
Apply patches available from the vendor according to the references. As remedial measures, consider restricting network access to the pod network only from trusted sources and limiting the ingress-nginx controller's permissions to Secrets in accordance with the principle of least privilege.
Kubernetes clusters using the ingress-nginx controller; versions indicated in the vendor's references
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H