Versions before 1.5 of the Kubernetes NGINX Ingress Controller, exposed the prometheus '/metrics' endpoint publicly by default. A remote user could view cluster metrics without authenticating. Upstream Issue: https://github.com/kubernetes/ingress-nginx/pull/3125
Statement: OpenShift Container Platform is not affected by this flaw as it neither uses the Kubernetes NGINX Ingress Controller nor exposes exposes metrics publicly without authentication.