Summary
A security issue was discovered in ingress-nginx where a user that can create or update Ingress objects can use directives to bypass the sanitization of the spec.rules[].http.paths[].path field of an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster. Multi-tenant environments where non-admin users have permissions to create Ingress objects are most affected.
Impact
By crafting a malicious path value, an attacker with Ingress create or update permissions can inject nginx directives through the spec.rules[].http.paths[].path field and gain access to the ingress-nginx controller's service account token. Because that token has cluster-wide secret read access by default, the attacker can escalate to reading all secrets in the cluster, including credentials for other workloads. Clusters that do not have ingress-nginx installed are not affected. If the chrooted controller image (introduced in v1.2.0) is in use, credential extraction is not possible, so the severity is lower.
Detection
Review all Ingress objects in the cluster for paths containing unexpected characters or directive sequences. Kubernetes audit logs should be examined for Ingress create and update events from users with limited privileges. The ingress-nginx controller logs may show unusual nginx configuration generation errors that could indicate attempted exploitation. If you find evidence that this vulnerability has been exploited, contact security@kubernetes.io.
Mitigation
Upgrade ingress-nginx to v1.8.0 or later.
As a configuration-level mitigation without upgrading, Ingress administrators should enable strict path type validation. When pathType is set to Exact or Prefix, ingress-nginx enforces strict validation allowing only paths starting with / and containing only alphanumeric characters and -, _, and additional /. This validation is enforced in the Admission Webhook, denying creation of any Ingress containing invalid characters unless pathType is ImplementationSpecific. See the ingress-nginx strict-validate-path-type documentation for configuration details. For environments that require ImplementationSpecific paths, restrict access to creating Ingress objects to trusted users only — for example, using OPA as described in the ingress-nginx OPA example.