CVE-2025-1974
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Tags
Description
A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Analysis
A critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access to achieve arbitrary code execution in the controller context. Dubbed 'IngressNightmare', this flaw exposes cluster Secrets including TLS certificates and service account tokens accessible to the ingress controller.
Technical Context
The ingress-nginx controller's admission webhook validates Ingress resources but can be exploited to inject arbitrary NGINX configuration directives. By sending crafted AdmissionReview requests to the webhook endpoint, an attacker with pod network access can inject configuration that causes the controller to execute arbitrary code. The controller typically has read access to all cluster Secrets for TLS termination.
Affected Products
['ingress-nginx controller (default Kubernetes installation)', 'Kubernetes clusters using ingress-nginx for ingress management']
Remediation
Update ingress-nginx controller to the patched version. Restrict network access to the admission webhook endpoint using NetworkPolicies. Minimize the controller's RBAC permissions. Consider migrating to alternative ingress controllers with smaller privilege footprints.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today