Summary
A security issue in ingress-nginx allows users with permission to create or update Ingress resources to inject arbitrary nginx configuration via the mirror-target and mirror-host annotations. Because the ingress-nginx controller processes these annotations without sufficient sanitization, a specially crafted annotation value can break out of the intended configuration context and execute arbitrary code within the controller process.
Impact
Any authenticated Kubernetes user who can create or modify Ingress resources — including users with limited namespace-scoped RBAC permissions — can exploit this vulnerability to achieve arbitrary code execution in the ingress-nginx controller. In the default installation, the controller holds cluster-wide read access to all Secrets, making this vulnerability a path to full cluster Secret disclosure. The CVSS score of 8.8 reflects that authentication is required (PR:L) but no user interaction is needed and all three impact categories are high.
Detection
Review Ingress resources across all namespaces for suspicious values in the mirror-target or mirror-host annotations:
kubectl get ingress --all-namespaces -o json | \
jq -r '.items[] | select(.metadata.annotations | keys[] | test("mirror-target|mirror-host")) | [.metadata.namespace, .metadata.name, (.metadata.annotations | to_entries[] | select(.key | test("mirror-target|mirror-host")) | .value)] | @tsv'
Unexpected nginx directives, newlines, or block syntax within those annotation values may indicate exploitation attempts. If you find evidence that this vulnerability has been exploited, contact security@kubernetes.io.
Mitigation
Upgrade ingress-nginx immediately to one of the patched versions:
- v1.11.5 or later (for the 1.11.x release line)
- v1.12.1 or later (for the 1.12.x release line)
Refer to the Upgrading Ingress-nginx documentation for upgrade instructions.
There is no published pre-patch workaround specific to this annotation pair. Restricting Ingress creation permissions to trusted users reduces the attack surface while an upgrade is being planned.