A high-severity configuration injection vulnerability in the Kubernetes ingress-nginx controller permits authenticated attackers to execute arbitrary code and access sensitive cluster secrets.

The vulnerability arises from improper input validation in the nginx.ingress.kubernetes.io/rewrite-target annotation, allowing an authenticated attacker with ingress creation privileges to inject configuration directives into the controller. This can result in remote code execution within the controller context and unauthorized access to all Secrets available to the controller cluster-wide.

The potential for arbitrary code execution and the exposure of sensitive cluster-wide Secrets presents a critical risk to the confidentiality, integrity, and availability of the entire Kubernetes environment. With a CVSS score of 8.8, this flaw is categorized as High, reflecting the significant impact on the security posture of cloud-native infrastructure. Successful exploitation could lead to full cluster compromise, enabling attackers to pivot into backend services or exfiltrate production credentials.

Immediate Action: Update the ingress-nginx controller to version 1.13.8, 1.14.4, or 1.15.0 immediately to apply the necessary input validation patches.

Proactive Monitoring: Review audit logs for unauthorized or suspicious modifications to Ingress resources, specifically monitoring for the use of the rewrite-target annotation in non-standard configurations.

Compensating Controls: Implement Kubernetes Admission Controllers or Policy Engines, such as OPA Gatekeeper or Kyverno, to restrict the use of dangerous annotations like rewrite-target across the cluster.

Public Exploit Available: Yes — a public proof-of-concept repository is available via GitHub.

Given the high impact of this vulnerability and the availability of a public proof-of-concept, security teams must prioritize upgrading their ingress-nginx controllers to the specified patched versions. Organizations should also audit their existing Ingress configurations to ensure that the rewrite-target annotation is not being abused. Failure to remediate this issue leaves the entire Kubernetes secret store vulnerable to unauthorized exfiltration.