CVE-2024-7646

CVE-2024-7646 is a high-severity vulnerability affecting ingress-nginx, allowing an attacker with Ingress object creation permissions to bypass annotation validation. This bypass enables arbitrary command injection, leading to the compromise of the ingress-nginx controller's credentials, which, by default, grants access to all cluster secrets. With a CVSS score of 8.8 (HIGH), the vulnerability is network-exploitable with low privileges and no user interaction, resulting in high confidentiality, integrity, and availability impacts. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered some community discussion, indicating awareness within the cybersecurity community.