Summary
A security issue in ingress-nginx allows users with permission to create or update Ingress resources to inject arbitrary nginx configuration via the auth-url annotation. This annotation, used to specify an external authentication service URL, is processed by the controller without sufficient sanitization unless the enable-annotation-validation CLI argument is enabled. A malicious annotation value can break out of the intended configuration block and execute arbitrary code within the controller process. The enable-annotation-validation option became enabled by default starting in ingress-nginx v1.12.0, but v1.12.0 is itself in the affected range; only v1.12.1 carries both the default and the fix.
Impact
Any authenticated Kubernetes user who can create or modify Ingress resources — including users with limited namespace-scoped RBAC permissions — can exploit this vulnerability to achieve arbitrary code execution in the ingress-nginx controller. In the default installation, the controller holds cluster-wide read access to all Secrets, making this vulnerability a path to full cluster Secret disclosure. The CVSS score of 8.8 reflects that authentication is required (PR:L) but no user interaction is needed and all three impact categories are high.
Detection
Review Ingress resources across all namespaces for suspicious values in the auth-url annotation:
kubectl get ingress --all-namespaces -o json | \
jq -r '.items[] | select(.metadata.annotations | keys[] | test("auth-url")) | [.metadata.namespace, .metadata.name, .metadata.annotations["nginx.ingress.kubernetes.io/auth-url"]] | @tsv'
Unexpected nginx directives, newlines, or block syntax within the annotation value may indicate an exploitation attempt. If you find evidence that this vulnerability has been exploited, contact security@kubernetes.io.
Mitigation
Upgrade ingress-nginx immediately to one of the patched versions:
- v1.11.5 or later (for the 1.11.x release line)
- v1.12.1 or later (for the 1.12.x release line)
Refer to the Upgrading Ingress-nginx documentation for upgrade instructions.
Prior to upgrading, this vulnerability can be mitigated by setting the enable-annotation-validation CLI argument to true on the ingress-nginx controller. This argument is not enabled by default on versions prior to v1.12.0 and must be explicitly set in the controller Deployment.