← Vulnerability feed

Vulnerability record · CVE-2020-8553 · published 29 July 2020

CVE-2020-8553: Kubernetes ingress-nginx vulnerability

Kubernetes · Ingress Nginx

The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyphenated namespace or secret name.

5.9 CVSS 3.1 Medium EPSS 0.89% · top 42.1% CWE-73 · CWE-73CWE-610 · CWE-610
5.9CVSS 3.1 base score, v2 4.9
0.89%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyphenated namespace or secret name.

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/kubernetes/ingress-nginx/issues/5126 Third Party Advisory
https://github.com/kubernetes/ingress-nginx/issues/5126 Third Party Advisory

Track CVE-2020-8553 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-3288Kubernetes ingress-nginx improper input validation vulnerabilityA security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/rewrite-target` Ingress annotation can be used to inject conf…EPSS 0.71%8.8CVE-2023-5043Kubernetes ingress-nginx improper input validation vulnerabilityIngress nginx annotation injection causes arbitrary command execution.EPSS 2.2%8.8CVE-2023-5044ingress-nginx permanent-redirect annotation code injectionCVE-2023-5044 is a code injection flaw in ingress-nginx reached through the nginx.ingress.kubernetes.io/permanent-redirect annotation, caused by impr…EPSS 57%analysed8.1CVE-2021-25745Kubernetes ingress-nginx improper input validation vulnerabilityA security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path fi…EPSS 1.2%7.1CVE-2021-25746Kubernetes ingress-nginx improper input validation vulnerabilityA security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use .metadata.annotations in an Ingress o…EPSS 1.4%7.1CVE-2021-25742Kubernetes ingress-nginx improper input validation vulnerabilityA security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain…EPSS 2.1%6.5CVE-2022-4886Kubernetes ingress-nginx improper input validation vulnerabilityIngress-nginx `path` sanitization can be bypassed with `log_format` directive.EPSS 1.6%6.5CVE-2021-25748Kubernetes ingress-nginx improper input validation vulnerabilityA security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the san…EPSS 0.69%

Source: NIST National Vulnerability Database (record CVE-2020-8553), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.