CVE-2021-25742CWE-20

Ingress-nginx custom snippets allows retrieval of ingress-nginx serviceaccount token and secrets across all namespaces

High · published October 29, 2021

CVSS v3.1
7.6
EPSS
2%
Percentile
81.2
In the wild
Unconfirmed
What it is

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.02067 · 81.2th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2021-10-29T04:05Z
EPSS history
Timeline
  • 29 OCT 04:05Z
    Ingress-nginx custom snippets allows retrieval of ingress-nginx serviceaccount token and secrets across all namespaces
    cvelistv5