# Config injection via unsanitized annotations

User-controlled annotations templated into generated proxy config without escaping, letting values become directives

_Area: Cloud and container security. Seen in 4 disclosed reports; 2 confirmed bounties: $2,500 and $2,500; latest 2025-03-24. Updated 2026-10-23._

## How it works
A controller takes user-supplied values (annotations, path fields) and writes them into a generated config file (nginx.conf) without escaping. The assumption that breaks: these values are inert data. In a config language, newlines, braces, or directive syntax let the value escape its slot and become new configuration. The generated config is then loaded or validated by a binary that honors directives capable of loading code or files.

## Where it shows up
- Any annotation or spec field templated into a config file: permanent-redirect, connection-proxy-header, configuration-snippet, server-snippet [E2](https://bugbountylibrary.com/r/h1%3A2039464.md)[E3](https://bugbountylibrary.com/r/h1%3A1378175.md)[E4](https://bugbountylibrary.com/r/h1%3A1249583.md)[E5](https://bugbountylibrary.com/r/h1%3A1728174.md)
- Admission controllers or validators that run `nginx -t` on attacker-influenced config [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-ingress-nginx-kubernetes-vulnerabilities.md)
- Template engines that escape some fields but not others [E3](https://bugbountylibrary.com/r/h1%3A1378175.md)
- Hardening that blacklists one directive while sibling fields stay unescaped [E5](https://bugbountylibrary.com/r/h1%3A1728174.md)
- Controllers whose serviceaccount can read secrets cluster-wide [E4](https://bugbountylibrary.com/r/h1%3A1249583.md)

## How to review
Enumerate every variable that reaches the rendered config and check each is escaped for that config's syntax, not just some. The invariant: no user value may introduce a newline, brace, or directive boundary. Then list directives/modules the consuming binary can execute (ssl_engine, load_module, lua blocks, include) and confirm none are reachable. For validators, treat the config test itself as an execution surface [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-ingress-nginx-kubernetes-vulnerabilities.md). Check the controller's RBAC scope, since its token is the exfil target [E4](https://bugbountylibrary.com/r/h1%3A1249583.md).

## Variants seen
- Annotation injection into nginx template, escalated via ssl_engine library load during `nginx -t` [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-ingress-nginx-kubernetes-vulnerabilities.md)
- permanent-redirect annotation injected despite snippet protections [E2](https://bugbountylibrary.com/r/h1%3A2039464.md)
- connection-proxy-header inserted verbatim due to partial escaping [E3](https://bugbountylibrary.com/r/h1%3A1378175.md)
- server-snippet lua reading the controller's over-privileged SA token [E4](https://bugbountylibrary.com/r/h1%3A1249583.md)
- Blacklisted alias directive bypassed via lua blocks in configuration-snippet [E5](https://bugbountylibrary.com/r/h1%3A1728174.md)

## Why fixes fail
Blacklisting a single directive (alias) left lua blocks usable [E5](https://bugbountylibrary.com/r/h1%3A1728174.md). Disabling snippet annotations left other annotations injectable [E2](https://bugbountylibrary.com/r/h1%3A2039464.md). Partial escaping left sibling fields open [E3](https://bugbountylibrary.com/r/h1%3A1378175.md).

## Impact and severity
Critical: unauthenticated RCE and cluster-wide secret theft [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-ingress-nginx-kubernetes-vulnerabilities.md), controller RCE and ServiceAccount token theft across namespaces [E2](https://bugbountylibrary.com/r/h1%3A2039464.md)[E3](https://bugbountylibrary.com/r/h1%3A1378175.md)[E4](https://bugbountylibrary.com/r/h1%3A1249583.md)[E5](https://bugbountylibrary.com/r/h1%3A1728174.md). Severity rises with unauthenticated reach and broad credential scope.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-ingress-nginx-kubernetes-vulnerabilities.md
- E2: https://bugbountylibrary.com/r/h1%3A2039464.md
- E3: https://bugbountylibrary.com/r/h1%3A1378175.md
- E4: https://bugbountylibrary.com/r/h1%3A1249583.md
- E5: https://bugbountylibrary.com/r/h1%3A1728174.md