Five significant vulnerabilities, collectively termed IngressNightmare, have been found in the Ingress NGINX Controller for Kubernetes, potentially exposing over 6,500 clusters to unauthorized remote code execution. These vulnerabilities, identified by cloud security firm Wiz, primarily affect the admission controller component, allowing attackers to execute arbitrary code via malicious ingress objects. This flaw, which does not impact NGINX Ingress Controller, has a CVSS score of 9.8 and presents a critical risk since 43% of cloud environments could be vulnerable, leading to unauthorized access to sensitive data.
Exploitation of these vulnerabilities leads to unauthorized access to all secrets stored across all namespaces in the Kubernetes cluster by attackers, which can result in cluster takeover.
The admission controller's elevated privileges and unrestricted network accessibility create a critical escalation path, allowing an attacker to execute arbitrary code and access all cluster secrets across namespaces.
Collection
[
|
...
]