{"id":"CVE-2024-7646","aliases":["EUVD-2024-48533","GHSA-qx8j-xj5q-v7r3","GO-2024-3075"],"status":"published","title":"A security issue was discovered in ingress-nginx where an actor with permission to create Ingress...","description":"A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `extensions` API group) can bypass annotation validation to inject arbitrary commands and obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.27018,"percentile":0.98055,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-20"],"published":"2024-08-16T17:36:53Z","modified":"2026-10-28T02:31:14Z","exploits":[{"source":"pocgithub","id":"dovics/cve-2024-7646","title":"dovics/cve-2024-7646","date":"2024-09-25","url":"https://github.com/dovics/cve-2024-7646"},{"source":"pocgithub","id":"r0binak/CVE-2024-7646","title":"r0binak/CVE-2024-7646","date":"2024-08-29","url":"https://github.com/r0binak/CVE-2024-7646"}],"affected":[{"source":"osv","ecosystem":"Go","package":"github.com/kubernetes/ingress-nginx","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}],"products":[{"vendor":"kubernetes","product":"ingress-nginx"}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/126744","tags":["issue-tracking","report"]},{"url":"https://groups.google.com/g/kubernetes-security-announce/c/a1__cKjWkfA","tags":["mailing-list","article","web"]},{"url":"https://github.com/kubernetes/ingress-nginx/pull/11719","tags":["patch","fix"]},{"url":"https://github.com/kubernetes/ingress-nginx/pull/11721","tags":["patch","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2024/08/16/5","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7646","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qx8j-xj5q-v7r3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/7xxx/CVE-2024-7646.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-7646","description":"A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `extensions` API group) can bypass annotation validation to inject arbitrary commands and obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.","status":"published","published":"2024-08-16T17:36:53.783Z","modified":"2024-08-19T18:28:09.677Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:34:20.673123Z"}],"euvd":[{"id":"EUVD-2024-48533","description":"A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `extensions` API group) can bypass annotation validation to inject arbitrary commands and obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.","status":"published","published":"2024-08-16T17:36:53Z","modified":"2024-08-19T18:28:09Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:56:15.111746Z"}],"ghsa":[{"id":"GHSA-qx8j-xj5q-v7r3","title":"A security issue was discovered in ingress-nginx where an actor with permission to create Ingress...","description":"A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `extensions` API group) can bypass annotation validation to inject arbitrary commands and obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.","status":"published","published":"2024-08-16T18:30:57Z","modified":"2024-08-16T18:31:08Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:57:59.707995Z"}],"nvd":[{"id":"CVE-2024-7646","description":"A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `extensions` API group) can bypass annotation validation to inject arbitrary commands and obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.","status":"published","published":"2024-08-16T18:15:10.97Z","modified":"2026-06-17T08:20:36.66Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:10:19.135392Z"}],"osv":[{"id":"CVE-2024-7646","description":"A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `extensions` API group) can bypass annotation validation to inject arbitrary commands and obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.","status":"published","published":"2024-08-16T17:36:53.783Z","modified":"2026-10-28T02:31:14.00841078Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:44:45.405014Z"},{"id":"GO-2024-3075","title":"CVE-2024-7646 in github.com/kubernetes/ingress-nginx","description":"CVE-2024-7646 in github.com/kubernetes/ingress-nginx.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/kubernetes/ingress-nginx before v1.11.2.","status":"published","published":"2024-08-19T17:26:32Z","modified":"2026-05-20T08:11:52.481008506Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}