Kubernetes
CVE-2025-1974
CRITICAL
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Component isolation
|
| Impact | CVSS 9.8, EPSS 90.3%, PoC available. ingress-nginx is the most widely deployed Kubernetes ingress controller. The controller runs with extensive cluster permissions by default. A compromised ingress controller can access TLS private keys, database credentials stored as Secrets, and service account tokens enabling cluster takeover. |
| Exploit ScenarioDerived | An attacker gains access to the pod network via a compromised application container or exposed service. They send crafted AdmissionReview requests to the ingress-nginx admission webhook, injecting configuration that executes a reverse shell. From the ingress controller pod, they enumerate and exfiltrate all Kubernetes Secrets, including database passwords, TLS keys, and cloud provider credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 28, 2026
A critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access to achieve arbitrary code execution in the controller context. Dubbed 'IngressNightmare', this flaw exposes cluster Secrets including TLS certificates and service account tokens accessible to the ingress controller.
Earlier versions of this analysis (1)
Unauthenticated RCE in Kubernetes ingress-nginx controller ('IngressNightmare') allows cluster-wide Secret exfiltration from the pod network.
RemediationAI
Update ingress-nginx controller to the patched version. Restrict network access to the admission webhook endpoint using NetworkPolicies. Minimize the controller's RBAC permissions. Consider migrating to alternative ingress controllers with smaller privilege footprints.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The ingress-nginx controller's admission webhook validates Ingress resources but can be exploited to inject arbitrary NGINX configuration directives. By sending crafted AdmissionReview requests to the webhook endpoint, an attacker with pod network access can inject configuration that causes the controller to execute arbitrary code. The controller typically has read access to all cluster Secrets for TLS termination.
Know when Kubernetes gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Executive ViewAI
Organizations using A security face critical risk from CVE-2025-1974 rated CVSS 9.8. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. With an EPSS score of 90%, this vulnerability faces very high likelihood of exploitation. Organizations should apply vendor updates immediately when available and implement compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Exploit-DB
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Kubernetes
View allCredential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Kamaji is the Hosted Control Plane Manager for Kubernetes. Rated critical severity (CVSS 9.9), this vulnerability is rem
Same weakness CWE-653 – Improper Isolation or Compartmentalization
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Linux Enterprise Server 16.1 | Fixed |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Fixed |