CVE-2021-25745

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.

• CWE-20
• CWE-20

• https://github.com/kubernetes/ingress-nginx/issues/8502Issue Tracking, Mitigation, Third Party Advisory
• https://groups.google.com/g/kubernetes-security-announce/c/7vQrpDZeBlcIssue Tracking, Mailing List, Mitigation, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220609-0006/Third Party Advisory
• https://github.com/kubernetes/ingress-nginx/issues/8502Issue Tracking, Mitigation, Third Party Advisory
• https://groups.google.com/g/kubernetes-security-announce/c/7vQrpDZeBlcIssue Tracking, Mailing List, Mitigation, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220609-0006/Third Party Advisory

Published

May 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-25737A security issue was discovered in Kubernetes where a user m…4.8
• CVE-2021-25738Loading specially-crafted yaml with the Kubernetes Java Clie…6.7
• CVE-2021-25740A security issue was discovered with Kubernetes that could e…3.1
• CVE-2021-25741A security issue was discovered in Kubernetes where a user m…8.1
• CVE-2021-25742A security issue was discovered in ingress-nginx where a use…7.1
• CVE-2021-25743kubectl does not neutralize escape, meta or control sequence…3
• CVE-2021-25746A security issue was discovered in ingress-nginx where a use…7.1
• CVE-2021-25748A security issue was discovered in ingress-nginx where a use…6.5
• CVE-2021-25749Windows workloads can run as ContainerAdministrator even whe…7.8
• CVE-2021-25755In JetBrains Code With Me before 2020.3, an attacker on the …2.5
• CVE-2021-25756In JetBrains IntelliJ IDEA before 2020.2, HTTP links were us…5.3
• CVE-2021-25757In JetBrains Hub before 2020.1.12629, an open redirect was p…6.1