CVE-2024-7646

A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `extensions` API group) can bypass annotation validation to inject arbitrary commands and obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

27.02% chance of exploitation in the next 30 days, 98th percentile

Published

2024-08-16

Updated

2024-08-19

Proof-of-concept exploits (2)

• dovics/cve-2024-76461★ · 2024-09-25
• r0binak/CVE-2024-76460★ · 2024-08-29

References

• CVE Record
• NVD entry

Related

• CVE-2023-5043
• CVE-2023-5044
• CVE-2024-0132
• CVE-2024-3094
• CVE-2025-23266
• CVE-2026-46680