CVE-2024-7646

HIGH EPSS 97.8%
Published Aug 16, 20241y ago · Modified Jun 17, 20262w ago
8.8 CVSS 3.1
High
Find Similar
Published Aug 16, 2024 1y ago
Last Modified Jun 17, 2026 2w ago

Description

A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `extensions` API group) can bypass annotation validation to inject arbitrary commands and obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.

CVSS Details

Base Score
8.8
Exploitability
2.8
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
97.8% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-20 Improper Input Validation Validation

References 5

  • openwall.com http://www.openwall.com/lists/oss-security/2024/08/16/5
  • github.com https://github.com/kubernetes/ingress-nginx/pull/11719
  • github.com https://github.com/kubernetes/ingress-nginx/pull/11721
  • github.com https://github.com/kubernetes/kubernetes/issues/126744
  • groups.google.com https://groups.google.com/g/kubernetes-security-announce/c/a1__cKjWkfA

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.