p PatchFirst

CVE-2024-7646

CVE-2024-7646

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `extensions` API group) can bypass annotation validation to inject arbitrary commands and obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.

CVSS 8.8 · High · EPSS 27.0% · Fix available

Published
Updated

Stack: containers

Affected products and versions

  • ingress-nginx

    Versions
    • ≥ 1.11.0, < 1.11.2: Affected (semver)
    • 1.11.2: Not affected
    • 1.10.4: Not affected
    • ≥ 0, < 1.10.4: Affected (semver)

    Update to 1.10.4; Update to 1.11.2

Original sources

Check your server →