CVE-2025-1974

Name of the Vulnerable Software and Affected Versions k8s.io/ingress-nginx versions prior to 1.11.5 k8s.io/ingress-nginx versions 1.12.0-beta.0 through 1.12.0

Description A security issue exists in the ingress-nginx controller due to insufficient input validation and inadequate spatial separation. An unauthenticated attacker with network access to the pod network can send a specially crafted request to the admission webhook endpoint on port 8443. This allows the attacker to inject malicious NGINX configurations and achieve arbitrary code execution in the context of the controller. Successful exploitation can lead to the disclosure of Kubernetes Secrets accessible to the controller, which, in default installations, may include all Secrets cluster-wide, potentially granting full control over the Kubernetes cluster.

Recommendations Update k8s.io/ingress-nginx to version 1.11.5 or later. Update k8s.io/ingress-nginx to version 1.12.1 or later. Restrict network access to the admission webhook on port 8443 to minimize the risk of exploitation.