-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| k8s.io/ingress-nginx | go | ||
| k8s.io/ingress-nginx | go |
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from improper isolation in admission controller validation (CWE-653). The patch notes mention disabling NGINX config validation during admission control, indicating ValidateIngress was involved in insecure validation. The admission controller's webhook setup (createApiserverConfig) likely exposed vulnerable endpoints. These functions would directly handle untrusted input validation and network exposure, aligning with the RCE vector described.
ValidateIngressinternal/ingress/controller/controller.go
createApiserverConfiginternal/ingress/admission/controller.go