A critical input validation flaw in the Kubernetes ingress-nginx controller allows authenticated attackers to achieve remote code execution and compromise cluster-wide secrets.

This vulnerability is caused by improper input validation of Ingress annotations, which permits an attacker with low-level privileges to inject configuration into the Nginx controller. Successful exploitation leads to arbitrary code execution within the controller context and unauthorized access to sensitive secrets.

The potential for remote code execution within the ingress-nginx controller poses a severe risk to the entire container orchestration environment. Given that the controller often possesses cluster-wide access to secrets, an attacker could exfiltrate sensitive credentials, tokens, or configuration data, leading to a complete compromise of the cluster. With a CVSS score of 8.8, this vulnerability represents a high-severity threat that necessitates immediate remediation to prevent lateral movement and data exfiltration.

Immediate Action: Update the ingress-nginx controller to version 1.13.9, 1.14.5, 1.15.1, or the latest available release provided by the maintainers.

Proactive Monitoring: Review Ingress object configurations for suspicious or non-standard annotations and monitor controller logs for unauthorized configuration changes or unexpected process execution.

Compensating Controls: Implement strict Kubernetes RBAC policies to limit which users or service accounts can modify Ingress resources, effectively reducing the attack surface for this configuration injection vector.

Public Exploit Available: Unknown

The ability to compromise cluster-wide secrets through simple annotation injection makes this vulnerability a priority for all Kubernetes administrators. Organizations should audit their current ingress-nginx deployments immediately and apply the necessary version updates to eliminate the configuration injection vector. Failure to patch may expose the entire cluster to unauthorized access and potential data breaches.