IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
4.8Media

CVE-2025-24513ingress-nginx controller - auth secret file path traversal vulnerability

kubernetes ingress-nginx Publicada: (hace 1 año)

Descripción

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.

Debilidad (CWE): CWE-20

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
kubernetes ingress-nginx ≤ 1.11.4, 1.12.0

Referencias y parches

CVE recientes del mismo producto — Kubernetes

2.7Baja
CVE-2026-116472

ingress-nginx mirror-target self-DOS

Kubernetes ingress-nginx; SUSE Rancher Prime RKE2 ingress-nginx

A security issue was discovered in ingress-nginx where a user with permission to create an Ingress may be able to cause denial of service of the ingress-nginx data plane, or possibly redirect traffic from other Ingresses. Kubernetes clusters are only affected…

5.8Media
CVE-2026-76654

Subpath symlinking on Windows nodes permits NTLM coercion

Kubernetes Kubernetes

An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network share. When a kubelet resolves symlinks, it does not reject a target that resolves…

2.7Baja
CVE-2026-15687

Path traversal via non-tar copyDirectoryFromPod

Kubernetes kubernetes-client/java

A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine executing copy operations via non-tar copyDirectoryFromPod when enableTarCompressing is false.