Vulnerability record · CVE-2021-25745 · published 6 May 2022

CVE-2021-25745: Kubernetes ingress-nginx improper input validation vulnerability

Kubernetes · Ingress Nginx

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.

8.1 CVSS 3.1 High EPSS 1.2% · top 33.5% CWE-20 · Improper input validation

8.1CVSS 3.1 base score, v2 5.5

1.2%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Ingress Nginx Kubernetes

References

Link	Tags
https://github.com/kubernetes/ingress-nginx/issues/8502	Issue TrackingMitigationThird Party Advisory
https://groups.google.com/g/kubernetes-security-announce/c/7vQrpDZeBlc	Issue TrackingMailing ListMitigationThird Party Advisory
https://security.netapp.com/advisory/ntap-20220609-0006/	Third Party Advisory
https://github.com/kubernetes/ingress-nginx/issues/8502	Issue TrackingMitigationThird Party Advisory
https://groups.google.com/g/kubernetes-security-announce/c/7vQrpDZeBlc	Issue TrackingMailing ListMitigationThird Party Advisory
https://security.netapp.com/advisory/ntap-20220609-0006/	Third Party Advisory

Track CVE-2021-25745 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-3288Kubernetes ingress-nginx improper input validation vulnerabilityA security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/rewrite-target` Ingress annotation can be used to inject conf…EPSS 0.71%9 Mar 2026 8.8CVE-2023-5043Kubernetes ingress-nginx improper input validation vulnerabilityIngress nginx annotation injection causes arbitrary command execution.EPSS 2.2%25 Oct 2023 8.8CVE-2023-5044ingress-nginx permanent-redirect annotation code injectionCVE-2023-5044 is a code injection flaw in ingress-nginx reached through the nginx.ingress.kubernetes.io/permanent-redirect annotation, caused by impr…EPSS 57%analysed25 Oct 2023 7.1CVE-2021-25746Kubernetes ingress-nginx improper input validation vulnerabilityA security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use .metadata.annotations in an Ingress o…EPSS 1.4%6 May 2022 7.1CVE-2021-25742Kubernetes ingress-nginx improper input validation vulnerabilityA security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain…EPSS 2.1%29 Oct 2021 6.5CVE-2022-4886Kubernetes ingress-nginx improper input validation vulnerabilityIngress-nginx `path` sanitization can be bypassed with `log_format` directive.EPSS 1.6%25 Oct 2023 6.5CVE-2021-25748Kubernetes ingress-nginx improper input validation vulnerabilityA security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the san…EPSS 0.69%24 May 2023 5.9CVE-2020-8553Kubernetes ingress-nginx vulnerabilityThe Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress obj…EPSS 0.89%29 Jul 2020

Source: NIST National Vulnerability Database (record CVE-2021-25745), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.