CVE-2021-25742

Name of the Vulnerable Software and Affected Versions ingress-nginx versions prior to v0.49.1 and prior to v1.0.1

Description A security issue was discovered where a user with the ability to create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster. This is particularly critical in multitenant environments where non-admin users have permissions to create Ingress resources. The custom snippets feature allows a user to execute arbitrary code through Lua in Nginx, potentially leading to access to the serviceaccount token and secrets across all namespaces.

Recommendations To resolve the issue, update ingress-nginx to version >= v0.49.1 or >= v1.0.1. Additionally, set allow-snippet-annotations to false in the ConfigMap to prevent exploitation.