{"id":"CVE-2018-1002104","aliases":["GHSA-p3x5-5xpx-9phm"],"title":"Kubernetes ingress exposes sensitive information","summary":"Kubernetes ingress exposes sensitive information","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","vendor":"ingress-nginx","product":"k8s.io/ingress-nginx","ecosystem":"go","affected":["k8s.io/ingress-nginx < 1.5"],"patched":["k8s.io/ingress-nginx 1.5"],"published":"2022-05-24","updated":"2026-08-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-p3x5-5xpx-9phm","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1002104"},{"url":"https://github.com/kubernetes/ingress-nginx/issues/1733"},{"url":"https://github.com/kubernetes/ingress-nginx/pull/3125"},{"url":"https://github.com/kubernetes/ingress-nginx/commit/d487a50e399100ad8db12ed1d2f92271f311f676"},{"url":"https://github.com/kubernetes/ingress-nginx"}],"tags":["osv","go"],"epss":0.01138,"epssPercentile":0.65157,"ingestedAt":"2026-08-07T19:14:17.407Z","slug":"CVE-2018-1002104","body":"## Overview\n\nVersions < 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly.\n\n## Affected packages\n\n- `k8s.io/ingress-nginx < 1.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `k8s.io/ingress-nginx 1.5`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}