CVE-2025-1098

Name of the Vulnerable Software and Affected Versions ingress-nginx versions prior to v1.11.5 ingress-nginx versions v1.12.0-beta.0 through v1.12.1

Description A security issue exists in ingress-nginx where the mirror-target and mirror-host Ingress annotations can be exploited to inject arbitrary configuration into nginx. Successful exploitation can lead to arbitrary code execution within the context of the ingress-nginx controller and potential disclosure of Secrets accessible to the controller. In a default installation, the controller has access to all Secrets cluster-wide. The issue stems from unsanitized mirror annotations.

Recommendations Upgrade to ingress-nginx version 1.11.5 or later. Upgrade to ingress-nginx version 1.12.1 or later.