ingress-nginx-controller-fips
7.6
CVSS V3
Ingress-nginx code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation
A security issue was identified in ingress-nginx where the nginx.ingress.kubernetes.io/permanent-redirect annotation on an Ingress object (in the networking.k8s.io or extensions API group) can be used to inject arbitrary commands, and obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.
