---
id: CVE-2020-8553
aliases:
  - GHSA-hhpm-74pm-hf35
title: ingress-nginx component for Kubernetes allows file overwrite
summary: ingress-nginx component for Kubernetes allows file overwrite
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N'
vendor: ingress-nginx
product: k8s.io/ingress-nginx
ecosystem: go
affected:
  - k8s.io/ingress-nginx < 0.28.0
patched:
  - k8s.io/ingress-nginx 0.28.0
published: '2022-05-24'
updated: '2026-08-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-hhpm-74pm-hf35'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2020-8553'
  - url: 'https://github.com/kubernetes/ingress-nginx/issues/5126'
  - url: 'https://github.com/kubernetes/ingress-nginx'
tags:
  - osv
  - go
epss: 0.00894
epssPercentile: 0.57455
ingestedAt: '2026-08-07T19:14:17.224Z'
---

## Overview

The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyphenated namespace or secret name.

## Affected packages

- `k8s.io/ingress-nginx < 0.28.0`

## Remediation

Upgrade to a patched release:

- `k8s.io/ingress-nginx 0.28.0`