{ "schemaVersion": "catalog-shared-check-receipt-v1", "subject": { "id": "ingress-nginx-ingress-nginx-4-15-1-internal-clusterip", "chart": "ingress-nginx/ingress-nginx", "version": "4.15.1", "base": "internal-clusterip", "renderPath": "recipes/ingress-nginx/ingress-nginx/4.15.1/revisions/internal-clusterip/r001/rendered/release-objects.yaml", "renderFileSHA256": "sha256:a94ba2b56636baf7e732766c12c98d808b57c276156fa7a3a752b4137bf5f46a" }, "catalogReview": { "path": "recipes/ingress-nginx/ingress-nginx/4.15.1/revisions/internal-clusterip/r001/receipts/scan-receipt.yaml", "note": "Separate chart-specific Catalog review; not a cub check result." }, "scannerResult": { "schema_version": "risk-scan-findings-v1", "surface": "cub-scan", "finding_count": 5, "findings": [ { "id": "CCVE-2025-3728", "name": "Deployment containers omit resource limits", "category": "CONFIG", "track": "misconfiguration", "detection_method": "native_rule", "severity": "warning", "confidence": "high", "tool": "kubernetes", "resource": { "kind": "Deployment", "name": "ingress-nginx-controller", "namespace": "ingress-nginx" }, "message": "Deployment containers omit resource limits", "remedy_type": "config_fix", "remedy_safety": "safe_auto", "remediation": { "steps": [ "Add resources.limits for memory and CPU to each container", "Add resources.requests to enable proper scheduling", "Consider LimitRange defaults at the namespace level" ], "commands": [ "kubectl get deployment -n -o yaml | grep -A10 resources", "kubectl set resources deployment -n --limits=cpu=500m,memory=256Mi --requests=cpu=100m,memory=128Mi" ] }, "evidence_source": "native", "control_ids": [ "CTRL-WORKLOAD-0002" ], "action_type": "mutating", "next_step": { "action": "apply_fix", "description": "Add resources.limits for memory and CPU to each container", "command": "kubectl get deployment -n -o yaml | grep -A10 resources", "doc_ref": "cub-scan --explain CCVE-2025-3728" } }, { "id": "CCVE-2025-3735", "name": "Container does not enforce readOnlyRootFilesystem", "category": "SECURITY", "track": "misconfiguration", "detection_method": "native_rule", "severity": "warning", "confidence": "high", "tool": "kubernetes", "resource": { "kind": "Deployment", "name": "ingress-nginx-controller", "namespace": "ingress-nginx" }, "message": "Container controller does not set readOnlyRootFilesystem: true", "remedy_type": "config_fix", "remedy_safety": "safe_auto", "remediation": { "steps": [ "Set securityContext.readOnlyRootFilesystem to true on every container", "Use emptyDir or tmpfs mounts for directories that need write access" ], "commands": [ "kubectl get deployment -n -o jsonpath='{.spec.template.spec.containers[*].securityContext}'" ] }, "evidence_source": "native", "control_ids": [ "CTRL-WORKLOAD-0001" ], "action_type": "mutating", "next_step": { "action": "apply_fix", "description": "Set securityContext.readOnlyRootFilesystem to true on every container", "command": "kubectl get deployment -n -o jsonpath='{.spec.template.spec.containers[*].securityContext}'", "doc_ref": "cub-scan --explain CCVE-2025-3735" } }, { "id": "CCVE-2025-3740", "name": "Deployment explicitly sets replicas to 1", "category": "CONFIG", "track": "misconfiguration", "detection_method": "native_rule", "severity": "info", "confidence": "high", "tool": "kubernetes", "resource": { "kind": "Deployment", "name": "ingress-nginx-controller", "namespace": "ingress-nginx" }, "message": "Deployment has replicas: 1; no high availability", "remedy_type": "config_fix", "remedy_safety": "safe_auto", "remediation": { "steps": [ "Set replicas to at least 2 for services requiring availability", "Use HPA with minReplicas >= 2 for auto-scaling workloads", "Single replica is acceptable for batch jobs or development" ], "commands": [ "kubectl get deployment -n -o jsonpath='{.spec.replicas}'" ] }, "evidence_source": "native", "action_type": "mutating", "next_step": { "action": "apply_fix", "description": "Set replicas to at least 2 for services requiring availability", "command": "kubectl get deployment -n -o jsonpath='{.spec.replicas}'", "doc_ref": "cub-scan --explain CCVE-2025-3740" } }, { "id": "CCVE-2025-3746", "name": "Deployment does not disable automountServiceAccountToken", "category": "SECURITY", "track": "misconfiguration", "detection_method": "native_rule", "severity": "warning", "confidence": "high", "tool": "kubernetes", "resource": { "kind": "Deployment", "name": "ingress-nginx-controller", "namespace": "ingress-nginx" }, "message": "Deployment does not set automountServiceAccountToken: false; pods get unnecessary API credentials", "remedy_type": "config_fix", "remedy_safety": "safe_auto", "remediation": { "steps": [ "Set automountServiceAccountToken to false in the pod spec", "Only enable it for pods that genuinely need Kubernetes API access", "Use dedicated service accounts with minimal RBAC for pods that need API access" ], "commands": [ "kubectl get deployment -n -o jsonpath='{.spec.template.spec.automountServiceAccountToken}'" ] }, "evidence_source": "native", "control_ids": [ "CTRL-RBAC-0002" ], "action_type": "mutating", "next_step": { "action": "apply_fix", "description": "Set automountServiceAccountToken to false in the pod spec", "command": "kubectl get deployment -n -o jsonpath='{.spec.template.spec.automountServiceAccountToken}'", "doc_ref": "cub-scan --explain CCVE-2025-3746" } }, { "id": "CCVE-2025-4078", "name": "ClusterRole grants secrets read permissions", "category": "SECURITY", "track": "misconfiguration", "detection_method": "native_rule", "severity": "critical", "confidence": "high", "tool": "kubernetes", "resource": { "kind": "ClusterRole", "name": "ingress-nginx", "namespace": "default" }, "message": "ClusterRole grants secrets get/list, enabling credential exfiltration across namespaces", "remedy_type": "config_fix", "remedy_safety": "safe_auto", "remediation": { "steps": [ "Remove secrets get/list permissions from ClusterRoles that do not require credential access", "Scope secret access to namespaced Role bindings where possible" ], "commands": [ "kubectl get clusterroles -o json | jq '.items[] | select(any(.rules[]?; any(.resources[]?; .==\"secrets\"))) | .metadata.name'" ] }, "evidence_source": "native", "control_ids": [ "CTRL-RBAC-0001" ], "action_type": "mutating", "next_step": { "action": "apply_fix", "description": "Remove secrets get/list permissions from ClusterRoles that do not require credential access", "command": "kubectl get clusterroles -o json | jq '.items[] | select(any(.rules[]?; any(.resources[]?; .==\"secrets\"))) | .metadata.name'", "doc_ref": "cub-scan --explain CCVE-2025-4078" } } ], "provenance": { "source": "cub-scan", "source_version": "v0.7.3", "scan_time": "2026-08-24T16:00:36Z", "catalog_version": "risk-catalog-v1.json@7ff79a126ad9" }, "pattern_bundle": { "schema_version": "bundle-manifest-v1", "version": "v0.7.3", "source_repo": "confighubai/confighub-scan", "manifest_sha256": "0405f6ffe21e567adf5d6a732d181c7f228194920456d046b4338baeb14de1a8", "catalog_sha256": "7ff79a126ad99bba2505fec8b2b7711c03f50eb362141128ec1c83e27a5036ba" }, "input": { "object_count": 9, "object_set_sha256": "sha256:c16ec6399544a46fc5816c6501531367930360250428e1ff87e940d09981edb6" } } }