# Compromise of auth via subset/superset namespace names.

nginx ingress builds htpasswd filenames as {namespace}-{ingress}.passwd, so a crafted namespace/ingress split overwrites another ingress's auth file, bypassing HTTP auth.

- Payout: hidden
- Severity: medium
- Program: Kubernetes
- Found by (vendor credit): Alex Orange
- Found by: alex_orange
- Disclosed: 2020-10-30
- CVE: CVE-2020-8553
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/778803
- Library page: https://bugbountylibrary.com/r/h1%3A778803
- Tags: area:cloud domain:cloud impact:integrity kind:bounty platform:hackerone sev:medium tech:kubernetes tech:nginx technique:source-review vuln:auth-bypass vuln:path-traversal

**Target:** nginx ingress controller auth annotation htpasswd file path
**Root cause:** The htpasswd filename is built by concatenating namespace and ingress name with a hyphen (`{namespace}-{ingress}.passwd`), so different namespace/ingress pairs can map to the same file path.
**Steps:**
1. Install nginx ingress controller (0.26.1).
2. Create namespace `a` and ingress `b-c` in it with an auth annotation, generating `a-b-c.passwd`.
3. Create namespace `a-b` and ingress `c` in it with an auth annotation, generating the same `a-b-c.passwd` path.
4. The second ingress's htpasswd overwrites the first; auth to `a/b-c` is now governed by the attacker's file.
**How found:** Noticed the auth annotation writes a file named `{namespace}-{ingress}.passwd`, and reasoned that the hyphen delimiter is ambiguous, allowing a subset/superset namespace+ingress split to collide on the same path.
**Exploitation:** Attacker with namespace-creation rights creates a namespace that is a prefix subset of the target's `{namespace}-{ingress}` string, then an ingress supplying the remainder plus a chosen htpasswd, overwriting the victim's auth file and neutralizing HTTP basic auth.
**Insight:** When a controller derives filesystem paths from concatenated Kubernetes names, the delimiter is ambiguous: any two name pairs whose hyphen-joined strings match collide. Look for `ns-name` style filenames and try splitting the target string differently across namespace and object name.