Summary
A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/rewrite-target Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. In the default installation, the ingress-nginx controller can access all Secrets cluster-wide.
Impact
Any Kubernetes user with permission to create or modify Ingress resources can craft a rewrite-target annotation value that injects arbitrary nginx directives into the generated nginx configuration. A successful injection can be used to execute code within the ingress-nginx controller process, and to read Secrets from any namespace that the controller's SA has access to — which in a default install is all Secrets cluster-wide. This gives an attacker with namespace-level Ingress creation rights a path to full cluster credential exposure.
Detection
The Kubernetes Security Response Committee advises that suspicious data within the rules.http.paths.path field of an Ingress resource could indicate an attempt to exploit this vulnerability. Operators should also audit nginx.ingress.kubernetes.io/rewrite-target annotation values across all Ingress resources for unexpected nginx directives, special characters, or unusually long strings. If evidence of exploitation is found, contact security@kubernetes.io.
Mitigation
Upgrade ingress-nginx to a patched release on the affected branch in use:
- 1.13.x branch: upgrade to 1.13.8 or later
- 1.14.x branch: upgrade to 1.14.4 or later
- 1.15.x branch: upgrade to 1.15.0 or later
Prior to upgrading, the vulnerability can be mitigated by using admission control to block the use of the rewrite-target annotation entirely. This can be done with a ValidatingAdmissionPolicy or a Kyverno/OPA Gatekeeper policy that rejects any Ingress resource containing the nginx.ingress.kubernetes.io/rewrite-target annotation.
For upgrade steps, refer to the Upgrading Ingress-nginx documentation.
If you do not have ingress-nginx installed, you are not affected. Verify with:
kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginx
Related Security Guidance
- Ingress Security — securing ingress controllers and annotation handling
- Securing Kubernetes Admission Controllers — using admission control to block dangerous annotations
- Misconfigured Admission Controllers — how admission controller weaknesses are exploited