{"id":"CVE-2023-5043","aliases":["EUVD-2023-2661","GHSA-5wj4-wffq-3378"],"status":"published","title":"Ingress nginx annotation injection causes arbitrary command execution","description":"Ingress nginx annotation injection causes arbitrary command execution.","severity":{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02489,"percentile":0.84753,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20","CWE-74"],"published":"2023-10-25T19:18:57Z","modified":"2026-10-28T02:30:29Z","exploits":[{"source":"pocgithub","id":"r0binak/CVE-2023-5043","title":"r0binak/CVE-2023-5043","date":"2024-01-15","url":"https://github.com/r0binak/CVE-2023-5043"}],"fixes":[{"ecosystem":"Go","package":"k8s.io/ingress-nginx","fixed_in":["1.9.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"k8s.io/ingress-nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/ingress-nginx","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.9.0"}]}]}],"products":[{"vendor":"kubernetes","product":"ingress-nginx"}],"references":[{"url":"https://github.com/kubernetes/ingress-nginx/issues/10571","tags":["issue-tracking","x_transferred","Issue Tracking","Mitigation","Vendor Advisory","report","web"]},{"url":"https://groups.google.com/g/kubernetes-security-announce/c/pVsXsOpxYZo","tags":["mailing-list","x_transferred","Mailing List","Mitigation","article","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/10/25/4","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240307-0012/","tags":["x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5043","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240307-0012","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5wj4-wffq-3378"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5043.json","tags":["advisory"]},{"url":"https://github.com/kubernetes/ingress-nginx","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-5043","title":"Ingress nginx annotation injection causes arbitrary command execution","description":"Ingress nginx annotation injection causes arbitrary command execution.","status":"published","published":"2023-10-25T19:18:57.704Z","modified":"2025-02-13T17:19:26.664Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:35:17.149492Z"}],"euvd":[{"id":"EUVD-2023-2661","description":"Ingress nginx annotation injection causes arbitrary command execution.","status":"published","published":"2023-10-25T19:18:57Z","modified":"2025-02-13T17:19:26Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-03T00:03:48.029386Z"}],"ghsa":[{"id":"GHSA-5wj4-wffq-3378","title":"Ingress nginx annotation injection causes arbitrary command execution","description":"### Issue Details\nA security issue was identified in ingress-nginx where the nginx.ingress.kubernetes.io/configuration-snippet annotation on an Ingress object (in the networking.k8s.io or extensions API group) can be used to inject arbitrary commands, and obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.\n\nThis issue has been rated High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L), and assigned CVE-2023-5043.\n\n### Affected Components and Configurations\nThis bug affects ingress-nginx. If you do not have ingress-nginx installed on your cluster, you are not affected. You can check this by running kubectl get po -n ingress-nginx.\n\nIf you are running the “chrooted” ingress-nginx controller introduced in v1.2.0 (gcr.io/k8s-staging-ingress-nginx/controller-chroot), command execution is possible but credential extraction is not, so the High severity does not apply.\n\nMulti-tenant environments where non-admin users have permissions to create Ingress objects are most affected by this issue.\n\n#### Affected Versions\n\u003cv1.9.0\n#### Versions allowing mitigation\nv1.9.0\n### Mitigation\nIngress Administrators should set the --enable-annotation-validation flag to enforce restrictions on the contents of ingress-nginx annotation fields.\n\n### Detection\nIf you find evidence that this vulnerability has been exploited, please contact security@kubernetes.io\n\n### Additional Details\nSee ingress-nginx Issue [#10571](https://github.com/kubernetes/ingress-nginx/issues/10571) for more details.\n\n### Acknowledgements\nThis vulnerability was reported by suanve\n\nThank You,\nCJ Cullen on behalf of the Kubernetes Security Response Committee","status":"published","published":"2023-10-25T21:30:33Z","modified":"2025-02-13T19:18:23Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-20","CWE-74"],"updated_at":"2026-11-02T14:38:31.416868Z"}],"nvd":[{"id":"CVE-2023-5043","description":"Ingress nginx annotation injection causes arbitrary command execution.","status":"published","published":"2023-10-25T20:15:18.037Z","modified":"2026-06-17T06:47:25.36Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-20","CWE-74"],"updated_at":"2026-11-02T14:08:40.004465Z"}],"osv":[{"id":"CVE-2023-5043","title":"Ingress nginx annotation injection causes arbitrary command execution","description":"Ingress nginx annotation injection causes arbitrary command execution.","status":"published","published":"2023-10-25T19:18:57.704Z","modified":"2026-10-28T02:30:29.952524683Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:44:35.245372Z"},{"id":"GHSA-5wj4-wffq-3378","title":"Ingress nginx annotation injection causes arbitrary command execution","description":"### Issue Details\nA security issue was identified in ingress-nginx where the nginx.ingress.kubernetes.io/configuration-snippet annotation on an Ingress object (in the networking.k8s.io or extensions API group) can be used to inject arbitrary commands, and obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.\n\nThis issue has been rated High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L), and assigned CVE-2023-5043.\n\n### Affected Components and Configurations\nThis bug affects ingress-nginx. If you do not have ingress-nginx installed on your cluster, you are not affected. You can check this by running kubectl get po -n ingress-nginx.\n\nIf you are running the “chrooted” ingress-nginx controller introduced in v1.2.0 (gcr.io/k8s-staging-ingress-nginx/controller-chroot), command execution is possible but credential extraction is not, so the High severity does not apply.\n\nMulti-tenant environments where non-admin users have permissions to create Ingress objects are most affected by this issue.\n\n#### Affected Versions\n\u003cv1.9.0\n#### Versions allowing mitigation\nv1.9.0\n### Mitigation\nIngress Administrators should set the --enable-annotation-validation flag to enforce restrictions on the contents of ingress-nginx annotation fields.\n\n### Detection\nIf you find evidence that this vulnerability has been exploited, please contact security@kubernetes.io\n\n### Additional Details\nSee ingress-nginx Issue [#10571](https://github.com/kubernetes/ingress-nginx/issues/10571) for more details.\n\n### Acknowledgements\nThis vulnerability was reported by suanve\n\nThank You,\nCJ Cullen on behalf of the Kubernetes Security Response Committee","status":"published","published":"2023-10-25T21:30:33Z","modified":"2026-08-07T08:12:21.781504267Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-20","CWE-74"],"updated_at":"2026-11-02T15:46:38.911014Z"}]}}