Target Industry
Indiscriminate, opportunistic targeting.
Overview
A set of five critical security vulnerabilities in the Ingress NGINX Controller for Kubernetes has been discovered. These have been tracked as CVE-2025-1097, CVE-2025-1098, CVE-2025-1974, CVE-2025-24513, and CVE-2025-24514.
Impact
The vulnerabilities in Ingress NGINX Controller can allow unauthenticated remote code execution (RCE), leading to unauthorised access to all secrets stored across namespaces in a Kubernetes cluster. The Ingress NGINX Controller is a Kubernetes component that manages and routes external traffic to services within the cluster using NGINX as a reverse proxy and load balancer. Clusters running Ingress NGINX versions below 1.12.1 or 1.11.5 are at risk.
Exploitation
The vulnerabilities exploit the admission controller component of the Ingress NGINX Controller, which is accessible over the network without authentication. Threat actors can inject malicious NGINX configurations to execute arbitrary code.
These are the vulnerabilities which have been exploited by threat actors:
- CVE-2025-1097 (CVSS score of 8.8): allows configuration injection via the auth-tls-match-cn Ingress annotation
- CVE-2025-1098 (CVSS score of 8.8): allows configuration injection via the mirror-target and mirror-host Ingress annotations
- CVE-2025-1974 (CVSS score of 9.8): allows unauthenticated attackers with access to the pod network
- CVE-2025-24513 (CVSS score of 4.8): allows improper input validation, leading to directory traversal within the container
- CVE-2025-24514 (CVSS score of 8.8): allows configuration injection via the auth-url Ingress annotation.
These vulnerabilities can lead to unauthorised access to all secrets stored across namespaces in a Kubernetes cluster, potentially resulting in a complete cluster takeover.
Containment, Mitigations & Remediation
It is highly recommended to update to the latest version, restrict access to the admission webhook using network policies, and temporarily disable the admission controller if upgrades aren’t possible.
Threat Landscape
Ingress NGINX Controller is one of the most popular ingress controllers used in Kubernetes environments. It is widely adopted across various industries for managing and routing external traffic to services within clusters.
Threat Group
The specific threat group behind this has not been publicly identified at the time of writing.
Further Information
