A high-severity configuration injection vulnerability in the Kubernetes ingress-nginx controller allows authenticated attackers to execute arbitrary code and access sensitive cluster data.

This flaw involves improper input validation (CWE-20) where the nginx.ingress.kubernetes.io/auth-proxy-set-headers annotation is improperly sanitized. An attacker with low privileges, capable of creating or updating Ingress resources, can inject arbitrary configuration into the Nginx controller process.

The ability to inject configuration into the ingress-nginx controller presents a critical risk to cluster integrity. By manipulating headers, an attacker can achieve arbitrary code execution within the controller container and potentially exfiltrate sensitive Kubernetes Secrets, which in default configurations may include cluster-wide credentials. With a CVSS score of 8.8, this vulnerability poses a severe threat to both data confidentiality and system availability.

Immediate Action: Upgrade to ingress-nginx versions 1.12.5 or 1.13.1 immediately to incorporate the necessary input validation fixes.

Proactive Monitoring: Review Ingress resource definitions for suspicious use of the auth-proxy-set-headers annotation and audit controller logs for unexpected configuration reload events.

Compensating Controls: Implement Kubernetes Admission Controllers or Policy Engines, such as OPA Gatekeeper or Kyverno, to restrict the use of dangerous annotations on Ingress objects until patching is complete.

Public Exploit Available: Unknown

Given the potential for full cluster compromise, organizations must prioritize upgrading the ingress-nginx controller to the specified patched versions. Security teams should verify that their RBAC policies strictly limit which users have the authority to manage Ingress resources, as this is the primary vector for triggering the vulnerability.