Database/Container, Kubernetes & orchestration
ingress-nginx: "IngressNightmare": unauthenticated RCE in the admission controller, reachable from any pod
Impact
"IngressNightmare": unauthenticated RCE in the admission controller, reachable from any pod, giving cluster-wide secret access and full cluster takeover
Who can reach it
Any pod on the cluster network, no credentials needed
What to do
Emergency controller upgrade, or delete the ValidatingWebhookConfiguration and network-restrict the admission port. Rolling controller upgrade, no GPU drain. The highest-priority item in this table for a multi-tenant neocloud
Fleet impact
How widespread
Very common - ingress-nginx is the default ingress on most managed and self-run K8s clusters, including the control planes neoclouds put in front of GPU tenants
Cost to remediate
daemon-restart (rolling deployment upgrade of the controller) - cheap on the ingress pods themselves, but the *cleanup* is the pain: every secret in every namespace must be assumed stolen and rotated
Why it hits the whole fleet
Anything on the pod network - i.e. any tenant workload - can hit the validating admission controller, load a shared library into the controller pod and read all secrets in all namespaces, which is cluster takeover
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.