Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 21 Oct 2021 09:26:08 -0700
From: CJ Cullen <>
Subject: [kubernetes] CVE-2021-25742: Ingress-nginx custom snippets allows
 retrieval of ingress-nginx serviceaccount token and secrets across all namespaces

Hello Kubernetes Community,

A security issue was discovered in ingress-nginx where a user that can
create or update ingress objects can use the custom snippets feature to
obtain all secrets in the cluster.

This issue has been rated High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
and assigned CVE-2021-25742.
Affected Components and Configurations

This bug affects ingress-nginx.

Multitenant environments where non-admin users have permissions to create
Ingress objects are most affected by this issue.
Affected Versions with no mitigation



   <= v0.49.0

Versions allowing mitigation

This issue cannot be fixed solely by upgrading ingress-nginx. It can be
mitigated in the following versions:





To mitigate this vulnerability:


   Upgrade to a version that allows mitigation, (>= v0.49.1 or >= v1.0.1)

   Set allow-snippet-annotations
   to false in your ingress-nginx ConfigMap based on how you deploy

Static Deploy Files

Edit the ConfigMap for ingress-nginx after deployment

kubectl edit configmap -n ingress-nginx ingress-nginx-controller

Add directive:


  allow-snippet-annotations: “false”

More information on the ConfigMap here

Deploying Via Helm

Set controller.allowSnippetAnnotations to false in the Values.yaml or add
the directive to the helm deploy

helm install [RELEASE_NAME] --set controller.allowSnippetAnnotations=false


If you find evidence that this vulnerability has been exploited, please
Additional Details

See ingress-nginx Issue #7837
<> for more details.

This vulnerability was reported by Mitch Hulscher.

Thank You,

CJ Cullen on behalf of the Kubernetes Security Response Committee

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.