Kubernetes ingress exposes sensitive information

published 2020-01-14 6 y ago modified 2026-09-10 1 mo ago also GHSA-p3x5-5xpx-9phm , EUVD-2022-4671

cvss: 5.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.1%; EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits: 0; none known

Versions < 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly.

Patch / fix

fixed in 2 links 2

go k8s.io/ingress-nginx 1.5
Kubernetes k8s.gcr.io/defaultbackend 1.5

github.com/kubernetes/ingress-nginx@d487a50 commit
github.com/kubernetes/ingress-nginx#3125 pull request

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-1002104 updated 2025-11-21 cvss 5.3

kubernetes/ingress-nginx: /metrics endpoint exposed publicly by default

Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, atomic-openshift-clients, +7 more Red Hat OpenShift Container Platform 4 openshift, openshift-clients, openshift-kubelet, openshift-hyperkube, openshift-kube-apiserver, openshift-kube-scheduler, +2 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.14% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N
GitHub	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
go	k8s.io/ingress-nginx	<1.5	1.5

Affected products

Kubernetes k8s.gcr.io/defaultbackend

Classification

Weakness

CWE-215 Insertion of Sensitive Information Into Debugging Code
CWE-20 Improper Input Validation

References

github.com /kubernetes/ingress-nginx/pull/3125
web, patch, third-party-advisory
github.com /kubernetes/ingress-nginx/commit/d487a50e399100ad8db12ed1d2f92271f311f676
web
nvd.nist.gov /vuln/detail/CVE-2018-1002104
advisory
github.com /kubernetes/ingress-nginx/issues/1733
web
github.com /kubernetes/ingress-nginx
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary