FlagThis

Multiple critical security vulnerabilities, collectively named IngressNightmare, have been discovered in the Ingress NGINX Controller for Kubernetes. These flaws could lead to unauthenticated remote code execution (RCE), potentially exposing over 6,500 clusters to the public internet. The vulnerabilities, identified as CVE-2025-24513, CVE-2025-24514, CVE-2025-1097, CVE-2025-1098, and CVE-2025-1974, have a CVSS score of 9.8. Cloud security firm Wiz discovered these flaws and reported that approximately 43% of cloud environments are susceptible to these vulnerabilities.

Specifically, IngressNightmare affects the admission controller component of the Ingress NGINX Controller, which utilizes NGINX as a reverse proxy and load balancer. Attackers can exploit the unrestricted network accessibility of admission controllers by injecting malicious NGINX configurations, gaining unauthorized access to cluster secrets and potentially leading to a complete cluster takeover. Kubernetes users are urged to update to versions v1.11.5, v1.12.1, or later to mitigate these risks.

ImgSrc: blogger.googleu

References :

• Open Source Security: Multiple vulnerabilities in ingress-nginx
• The Hacker News: Critical Ingress NGINX Controller Vulnerability Allows RCE Without Authentication
• Wiz Blog | RSS feed: IngressNightmare: 9.8 Critical Unauthenticated Remote Code Execution Vulnerabilities in Ingress NGINX
• The Register - Software: Public-facing Kubernetes clusters at risk of takeover thanks to Ingress-Nginx flaw
• Open Source Security: [kubernetes] Multiple vulnerabilities in ingress-nginx
• ciso2ciso.com: Public-facing Kubernetes clusters at risk of takeover thanks to Ingress-Nginx flaw – Source: go.theregister.com
• securityonline.info: CVE-2025-1974 (CVSS 9.8): Ingress NGINX Flaws Threaten Mass Kubernetes Compromise
• dragosr: "CVE-2025-1974 means that anything on the Pod network has a good chance of taking over your Kubernetes cluster, with no credentials or administrative access required." ingress-nginx is deployed in 40% of k8s clusters.
• research.kudelskisecurity.com: Critical Unauthenticated Remote Code Execution Vulnerabilities inIngress NGINX
• securityboulevard.com: Security Boulevard answers FAQs about IngressNightmare.
• : Wiz Security finds four critical RCE vulnerabilities in the Ingress NGINX Controller for Kubernetes
• Resources-2: IngressNightmare: Ingress NGINX Remote Code Execution Vulnerability Explained
• www.csoonline.com: Critical RCE flaws put Kubernetes clusters at risk of takeover
• www.cybersecuritydive.com: Critical vulnerabilities put Kubernetes environments in jeopardy
• Arctic Wolf: CVE-2025-1974: Critical Unauthenticated RCE Vulnerability in Ingress NGINX for Kubernetes
• Tenable Blog: CVE-2025-1097, CVE-2025-1098, CVE-2025-1974, CVE-2025-24513, CVE-2025-24514: Frequently Asked Questions About IngressNightmare
• open-appsec: On March 24, 2025, WIZ Research disclosed critical vulnerabilities in the Kubernetes Ingress NGINX Controller that allow unsanitized user...
• Threats | CyberScoop: String of defects in popular Kubernetes component puts 40% of cloud environments at risk
• Blog: Ingress NGINX Kubernetes Controller vulnerabilities a ‘nightmare’ for impacted users
• circl: A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. CVE-2025-1974 but also CVE-2025-1097 CVE-2025-1098 CVE-2025-24513 CVE-2025-24514 🔗 For more details about Ingress NGINX Controller for Kubernetes release
• Sysdig: Detecting and Mitigating IngressNightmare – CVE-2025-1974
• thecyberexpress.com: Multiple CVEs Found in Ingress-NGINX—Patch Now to Prevent Cluster Compromise
• Datadog Security Labs: The "IngressNightmare" vulnerabilities in the Kubernetes Ingress NGINX Controller: Overview, detection, and remediation
• Information Security Buzz: Five critical security vulnerabilities have been found in the Ingress NGINX Controller for Kubernetes, potentially enabling unauthenticated remote code execution. This exposure puts over 6,500 clusters at immediate risk by making the component accessible via the public internet.
• MSSP feed for Latest: Researchers aren’t aware of active exploitation in the wild, but they warn the risk for publicly exposed and unpatched Ingress Nginx controllers is extremely high.
• Latest Bulletins: Addresses issues with Kubernetes ingress-nginx controller
• nsfocusglobal.com: Kubernetes Ingress-nginx Remote Code Execution Vulnerability (CVE-2025-1974)
• Dynatrace news: NGINX vulnerability: Quickly detect and mitigate IngressNightmare vulnerabilities with Dynatrace
• securityonline.info: ingress-nginx maintainers released fixes for multiple vulnerabilities that could allow threat actors to take over Kubernetes clusters.
• Delinea Blog: Discusses vulnerabilities enabling access to Kubernetes clusters’ secrets.
• Kali Linux Tutorials: Details on IngressNightmare Vulnerabilities

Classification:

• HashTags: #Kubernetes #Vulnerability #RCE
• Company: Kubernetes
• Target: Kubernetes Clusters
• Product: Ingress NGINX Controller
• Feature: Remote Code Execution
• Type: Vulnerability
• Severity: Critical