CVE-2021-25742 HIGH

CVE-2021-25742: Ingress-nginx custom snippets allows retrieval of ingress-nginx serviceaccount token and secrets across all namespaces

Vendor Kubernetes
Product Kubernetes ingress-nginx
Weakness CWE-20 · Input validation
Published October 29, 2021
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

7.6/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

What the vulnerability does

Description

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster.

Key dates

Disclosure timeline

October 29, 2021 CVE published
September 16, 2024 Record updated