#IngressNightmare: Wiz Research uncovers a critical vulnerability in Ingress-NGINX 🚨
Wiz Research found a novel attack vector in one of Kubernetes's most fundamental projects, Ingress-NGINX, which is rated CVSS 9.8.
Wiz Research found a novel attack vector in one of Kubernetes's most fundamental projects, Ingress-NGINX, which is rated CVSS 9.8.
Comments
One thing, though: I don't quite get your CVSS grading. The way I understand your text,you either need a misconfiguration (admission controller exposed to internet) or a pod compromise as a prerequisite, which would require a high complexity
Ingress-NGINX is found in over 40% of cloud environments. If you're using this project, your infrastructure could be at risk.
This vulnerability allows attackers to gain access to all secrets across all namespaces in a Kubernetes cluster — essentially enabling a cluster takeover.
A patch is available.
Upgrade to version v1.12.1, v1.11.5 to protect your environment.
Wiz research has worked closely with the Kubernetes maintainers over the last couple of months to fully mitigate this attack surface
📝 For full technical details: http://wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities