Kubernetes ingress-nginx Compromise of auth via subset/superset namespace names

published 2020-07-29 6 y ago modified 2026-08-07 3 mo ago also GHSA-hhpm-74pm-hf35 , EUVD-2022-4162

cvss: 5.9; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.9%; EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits: 0; none known

The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyphenated namespace or secret name.

Patch / fix

fixed in 2

go k8s.io/ingress-nginx 0.28.0
Kubernetes ingress-nginx 0.28.0

Exploit prediction

0.89% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.9	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
NVD	3.1	5.9	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
NVD	2.0	4.9	AV:N/AC:M/Au:S/C:P/I:P/A:N
GitHub	3.1	5.9	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
go	k8s.io/ingress-nginx	<0.28.0	0.28.0

Affected products

Kubernetes ingress-nginx

Classification

Weakness

CWE-73 External Control of File Name or Path
CWE-610 Externally Controlled Reference to a Resource in Another Sphere

Technology feeds

Kubernetes rss critical rss

References

github.com /kubernetes/ingress-nginx/issues/5126
web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2020-8553
advisory
github.com /kubernetes/ingress-nginx
package

Sources

CVE List CVE-2020-8553
GitHub Advisory GHSA-hhpm-74pm-hf35
NVD CVE-2020-8553

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary