Kubernetes ingress-nginx Compromise of auth via subset/superset namespace names

Also known as GHSA-hhpm-74pm-hf35

Published 6 y ago 2020-07-29 · modified 3 mo ago 2026-08-07 · JSON

CVSS

5.9

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.9%

percentile 60%

Public exploits

none known

The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyphenated namespace or secret name.

Exploit prediction (EPSS)

0.89% probability of exploitation in the next 30 days, higher than 60% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.1	5.9	`CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N`
CNA	3.1	5.9	`CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N`
NVD	3.1	5.9	`CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N`
NVD	2.0	4.9	`AV:N/AC:M/Au:S/C:P/I:P/A:N`
GitHub	3.1	5.9	`CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
go	`k8s.io/ingress-nginx`	<0.28.0	0.28.0

Affected products

Kubernetes ingress-nginx

Classification

Weakness

CWE-73 External Control of File Name or Path
CWE-610 Externally Controlled Reference to a Resource in Another Sphere

Technology feeds

Kubernetes (RSS, critical only)

References

github.com /kubernetes/ingress-nginx/issues/5126 · x_refsource_CONFIRM, x_transferred
nvd.nist.gov /vuln/detail/CVE-2020-8553 · advisory
github.com /kubernetes/ingress-nginx · package

Sources

CVE List: CVE-2020-8553
GitHub Advisory: GHSA-hhpm-74pm-hf35
NVD: CVE-2020-8553

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary