Skip to main content

Security Updates Released for Ingress NGINX Controller for Kubernetes

Five vulnerabilities discovered in Ingress NGINX Controller for Kubernetes could allow for takeover of a Kubernetes cluster

Threat ID:
CC-4636
Threat Severity:
Medium
Published:
25 March 2025 5:06 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Five vulnerabilities discovered in Ingress NGINX Controller for Kubernetes could allow for takeover of a Kubernetes cluster

Affected platforms

The following platforms are known to be affected:

Versions: all prior to 1.12.1, 1.11.5, and 1.10.7

NGINX Ingress Controller

Threat details

Proof-of-Concept exploit released

A proof-of-concept (PoC) exploit has been released for 

  • CVE-2025-1974
  • CVE-2025-1097
  • CVE-2025-1098
  • CVE-2025-24514

  • CVE-2025-24513

The NHS England National CSOC assess exploitation of these vulnerabilities as more likely.

Introduction

Five vulnerabilities have been discovered within the Ingress NGINX Controller for Kubernetes. NGINX Ingress Controller is a tool used in Kubernetes environments to manage and route external traffic to services within the cluster. Ingress Controller acts as a reverse proxy and load balancer, supporting various protocols like WebSocket, gRPC, TCP, and UDP, and also provides features such as content-based routing and TLS/SSL termination. 

Vulnerability details

  • CVE-2025-1974 - ingress-nginx admission controller RCE escalation

CVE-2025-1974 is a critical 'improper isolation or compartmentalisation' vulnerability with a CVSSv3 score of 9.8. An unauthenticated attacker with access to the pod network could execute arbitrary code within the ingress-nginx controller. As a result, an attacker could gain access to all cluster secrets across namespaces and control over the Kubernetes cluster. 

  • CVE-2025-1097, CVE-2025-1098 and CVE-2025-24514 - ingress-nginx controller configuration injection via unsanitised annotation 

CVE-2025-1097, CVE-2025-1098 and CVE-2025-24514 are high 'improper input validation' vulnerabilities, all with CVSSv3 scores of 8.8. An attacker could exploit ingress annotations to inject arbitrary configuration into ingress-nginx controller. As a result, an attacker could perform arbitrary code execution (ACE) within the ingress-nginx controller and expose secrets accessible to the controller.

  • CVE-2025-24513 - ingress-nginx controller auth secret file path traversal vulnerability

CVE-2025-24513 is a medium 'improper input validation' vulnerability with a CVSSv3 score of 4.8. An attacker could exploit the ingress-nginx admission controller feature to include attacker-provided data in a filename, leading to directory traversal within the container. This could result in denial-of-service (DOS), or when combined with other vulnerabilities, limited disclosure of secret objects from a Kubernetes cluster.

Threat updates

Date Update
27 Mar 2025 Corrected affected versions

Remediation advice

Affected organisations are strongly encouraged to review the ingress-nginx patch release and apply the relevant updates as soon as practicable.

Organisations unable to apply the patches should follow the mitigation guidance below.

Remediation steps

Type Step
Patch

Update to the latest version of ingress-nginx.


https://github.com/kubernetes/website/blob/4763f1ccc2fd51c42d71d589094f5b1cbca3ed2c/content/en/blog/_posts/2025-03-24-ingress-nginx-CVE-2025-1974.md
Guidance

Organisations unable to apply the relevant updates are encouraged to turn off the Validating Admission Controller feature of ingress-nginx using one of the following methods:

  • If you have installed ingress-nginx using Helm
    • Reinstall, setting the Helm value controller.admissionWebhooks.enabled=false
  • If you have installed ingress-nginx manually
    • delete the ValidatingWebhookconfiguration called ingress-nginx-admission
    • edit the ingress-nginx-controller Deployment or Daemonset, removing --validating-webhook from the controller container’s argument list

Note: Organisations that turn off the Validating Admission Controller feature as a mitigation for CVE-2025-1974, should remember to turn it back on after upgrade. This feature provides important quality of life improvements for your users, warning them about incorrect Ingress configurations before they can take effect.


https://github.com/kubernetes/website/blob/4763f1ccc2fd51c42d71d589094f5b1cbca3ed2c/content/en/blog/_posts/2025-03-24-ingress-nginx-CVE-2025-1974.md

CVE Vulnerabilities

Status Published

CVE-2025-24514

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Status Published

CVE-2025-1097

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Status Published

CVE-2025-1098

 A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Status Published

CVE-2025-24513

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.
Status Published

CVE-2025-1974

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

Last edited: 27 March 2025 1:51 pm