Summary
A security issue in ingress-nginx allows a user with permission to create or update Ingress objects to exploit .metadata.annotations on an Ingress object in the networking.k8s.io or extensions API group to inject nginx directives into the controller configuration. By doing so, the attacker can retrieve the credentials of the ingress-nginx controller. In the default configuration, those credentials have access to all secrets in the cluster.
Impact
Any user who can create or update Ingress objects in a cluster running ingress-nginx prior to v1.2.0 can leverage this vulnerability to obtain the ingress-nginx service account token. Because the default service account has cluster-wide access to secrets, the effective impact is full read access to all Kubernetes secrets. Multitenant environments where non-admin users hold Ingress create or update permissions are most at risk.
Detection
Audit which users and service accounts hold create or update access on Ingress resources, and review Ingress objects in the cluster for annotation values that contain nginx configuration directives or other unexpected content. If you find evidence that this vulnerability has been exploited, contact security@kubernetes.io.
Mitigation
Upgrade ingress-nginx to v1.2.0 (or the release candidate v1.2.0-beta.0) or later, which includes sanitization of annotation values.
If an immediate upgrade is not possible, implement an admission policy that restricts .metadata.annotations values on networking.k8s.io/Ingress resources to a known safe character set. The ingress-nginx project documents a suggested annotation-value-word-blocklist ConfigMap setting that provides a reference blocklist pattern for restricting annotation content.