CVE-2023-5044

HIGH7.6EPSS 10.6%

Ingress-nginx code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation

Published: 10/25/2023Modified: 5/20/2026

Also known as:GHSA-fp9f-44c2-cw27CGA-854f-8326-49p2GO-2024-2428

Description

A security issue was identified in [ingress-nginx](https://github.com/kubernetes/ingress-nginx) where the nginx.ingress.kubernetes.io/permanent-redirect annotation on an Ingress object (in the networking.k8s.io or extensions API group) can be used to inject arbitrary commands, and obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.

Affected packages (2)

Go/k8s.io/ingress-nginxfrom 0, < 1.9.0
Go/k8s.io/ingress-nginxfrom 0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
osv	CVSS 3.1	HIGH7.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

References (7)

ADVISORYhttps://github.com/advisories/GHSA-fp9f-44c2-cw27
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-5044
PATCHhttps://github.com/kubernetes/ingress-nginx
WEBhttps://github.com/kubernetes/ingress-nginx/issues/10572
WEBhttps://groups.google.com/g/kubernetes-security-announce/c/ukuYYvRNel0
WEBhttps://security.netapp.com/advisory/ntap-20240307-0012
WEBhttp://www.openwall.com/lists/oss-security/2023/10/25/3