Ingress-nginx allows a malicious attacker to embed configuration directives within comment-based annotations of Ingress resources. By crafting specific Ingress annotations, the attacker can inject arbitrary nginx configuration that is subsequently processed by the ingress-nginx controller. This injection can lead to arbitrary code execution in the controller's process space and the disclosure of Kubernetes Secrets that are accessible to the controller. The weakness is a failure of input validation (CWE‑20) and an unspecified CWE identified by NVD as NVD-CWE-noinfo.

The vulnerability affects implementations of the Kubernetes ingress-nginx controller. No specific affected versions are listed in the CNA data; therefore the risk applies to any deployment that has not applied a remedy. In the default configuration the controller mounts all cluster secrets, so a successful attack can expose a wide range of sensitive data. The vendor listed is Kubernetes:ingress-nginx.

The CVSS score is 8.8, indicating high severity. The EPSS score is 0.00052, indicating a very low probability of exploitation, and the vulnerability is not included in the CISA KEV catalog. The likely attack vector requires the ability to create or modify Ingress resources with malicious annotations, which typically requires Kubernetes RBAC privileges to write such resources. Once injected, the controller can execute the malicious configuration. The risk is therefore significant for clusters that grant wide permission to write Ingress objects and that run the controller with full cluster‑wide access to secrets.