New Kubernetes Ingress-nginx Vulnerability Alert: CVE-2021-25742

CVE-2021-25742 is a High-severity ingress-nginx vulnerability: a user who can create or update Ingress objects can use custom snippet annotations to read every secret in the cluster. Upgrading alone doesn’t fix it. Move to v1.0.1 or v0.49.1 or later, then set allow-snippet-annotations to false, or block snippet annotations with a Kyverno policy.

CVE-2021-25742 at a glance

Field	Detail
CVE	CVE-2021-25742
Component	ingress-nginx controller
Severity	High, CVSS 3.1 score 7.6 from Kubernetes (NVD: 7.1)
Affected with no mitigation	v1.0.0 and v0.49.0 or earlier
Versions allowing mitigation	v1.0.1 and v0.49.1 (not fixed by upgrading alone)
Mitigation	Set allow-snippet-annotations: "false", or enforce the Kyverno policy below

The facts above come from the official advisory in kubernetes/ingress-nginx#7837, its entry in the Kubernetes official CVE feed (kubernetes/kubernetes#126811) and the NVD record. Kubernetes SIG Network and the Security Response Committee have since announced the retirement of Ingress NGINX, with best-effort maintenance ending in March 2026 and no security fixes after that. For the ingress-nginx CVEs that followed, see Mitigating the Latest Kubernetes NGINX Ingress Controller CVEs and CVE-2024-7646.

What is CVE-2021-25742?

On October 21st, 2021, a CVE with respect to ingress-nginx was released by the Kubernetes Security Team where an attacker who can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster.

This issue affects clusters that are configured for multi-tenancy with non-root users who have access to configure ingress-objects. They can use the custom snippets feature in the ingress-object to obtain all secrets in the cluster.

Here are the details on the CVE-2021-25742: A user with privilege to create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster. This issue has been rated High and it is recommended to make sure that Kubernetes clusters with ingress-nginx enabled are not exposed with it.

How do you fix CVE-2021-25742?

This issue cannot be fixed only by upgrading the ingress-nginx. After upgrading ingress-nginx to a version that allows mitigation (>= v0.49.1 or >= v1.0.1), edit the ConfigMap to set the allow-snippet-annotations to false in your ingress-nginx ConfigMap:

data:
allow-snippet-annotations: “false”

Two things matter here. The upgrade only makes the setting available, and the setting only protects you once it is applied. Setting it to false also turns off every *-snippet annotation, so check which Ingresses use them before you change it.

How does Kyverno mitigate CVE-2021-25742?

One simple approach to solving this issue is to use Kyverno, an open-source Kubernetes native policy engine. Kyverno is a Kubernetes native policy engine that can validate, mutate and generate configuration and resources based on conditions. Kyverno’s admission control webhook can execute a simple policy that disables allow-snippet-annotations in the ingress-nginx configuration and blocks *-snippet annotations on an Ingress.

Here is a two-step process to implement the fix with Kyverno:

1. Deploy Kyverno in your cluster. Instructions are available here.
2. Add a policy to disable allow-snippet-annotations using a YAML-based policy, as shown below:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-ingress-nginx-custom-snippets
  annotations:
    policies.kyverno.io/title: Disallow Custom Snippets
    policies.kyverno.io/category: Best Practice
    policies.kyverno.io/subject: ConfigMap, Ingress
    policies.kyverno.io/minversion: 1.4.3
    policies.kyverno.io/description: >-
      Users that can create or update ingress objects can use the custom snippets 
      feature to obtain all secrets in the cluster (CVE-2021-25742). This policy 
      disables allow-snippet-annotations in the ingress-nginx configuration and 
      blocks *-snippet annotations on an Ingress.
      See: https://github.com/kubernetes/ingress-nginx/issues/7837      
spec:
  validationFailureAction: enforce
  rules:
    - name: check-config-map
      message: "ingress-nginx allow-snippet-annotations must be set to false"
      match:
        resources:
          kinds:
            - ConfigMap      
      validate:
        pattern:
          =(data):
            =(allow-snippet-annotations) : "false"
    - name: check-ingress-annotations
      message: "ingress-nginx custom snippets are not allowed"
      match:
        resources:
          kinds:
            - Ingress      
      validate:
        pattern:
          metadata:
            =(annotations):
              X(*-snippets): "?*"

How do you scope the policy to labelled resources?

This policy can further be enhanced to match configMaps or ingress with certain labels. If your organization policy requires labels for each application you deploy then you can update this policy to match the resources with certain labels:

- name: check-config-map
      match:
        resources:
          kinds:
            - ConfigMap
      preconditions:
        - key: "{{ request.object.metadata.labels.application }}"
          operator: Equal
          value: "nginx"
      validate:
        message: "ingress-nginx allow-snippet-annotations must be set to false"
        pattern:
          =(data):
            =(allow-snippet-annotations) : "false"

The above rule matches any configMap that has a label with key as application and value as nginx. The value can also be a wild card something like “*nginx*” which applies to any value that includes nginx.

Where to go next

There are other sample policies available in the Kyverno policy library. For more on running Kyverno, see Kyverno OSS and our Kyverno security advisories hub.

For any assistance with Kyverno, please open an issue here.

Frequently asked questions

How do I turn off snippet annotations when ingress-nginx is installed with Helm?

The advisory says to set controller.allowSnippetAnnotations to false in your values.yaml, or pass it on the command line with helm install [RELEASE_NAME] --set controller.allowSnippetAnnotations=false ingress-nginx/ingress-nginx. This sets allow-snippet-annotations to false in the controller ConfigMap, the same change the static-manifest instructions make by editing the ConfigMap after deployment.

Why do NVD and Kubernetes list different CVSS scores for CVE-2021-25742?

The Kubernetes Security Response Committee scored it 7.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L). NVD's own analysis scored it 7.1. Both rate it High. NVD publishes its score alongside the one from the reporting organization, and the two can differ when analysts weigh the integrity and availability impact differently.

What should I do if I think CVE-2021-25742 was exploited in my cluster?

The Kubernetes advisory asks you to contact [email protected] if you find evidence that this vulnerability has been exploited. Because the flaw exposes the ingress-nginx service account token and secrets across all namespaces, treat any secret the controller could read as exposed and plan to rotate it after you disable snippet annotations.