---
title: "IngressNightmare: ingress-nginx Cluster Takeover RCE"
url: https://erroneo.us/security/briefs/ingressnightmare-ingress-nginx-cve-2025-1974/
description: "Five ingress-nginx bugs, led by CVE-2025-1974 (9.8), let pod-network attackers take over clusters. Fixed in 1.11.5/1.12.1. Verdict: check exposure."
type: security-brief
section: "Security Digest"
date_published: 2025-03-24
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-1974", "CVE-2025-1097", "CVE-2025-1098", "CVE-2025-24514", "CVE-2025-24513"]
severity: "critical"
exploited: "public-poc"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# IngressNightmare: ingress-nginx Cluster Takeover RCE

**Verdict: Check exposure.** Patched since March 2025. If any cluster still runs ingress-nginx below 1.11.5 or 1.12.1, that is a cluster-takeover risk, and the controller itself is now retired, so plan the migration while you check.

- **Who must act:** Anyone running the Kubernetes community ingress-nginx controller older than v1.11.5 or v1.12.1 with the validating admission webhook enabled, especially if the webhook is reachable beyond the API server.
- **Who can relax:** Clusters with no ingress-nginx pods (including those using F5/NGINX Inc.'s separate NGINX Ingress Controller or other controllers) and clusters already on 1.11.5, 1.12.1 or later.
- **Affected:** ingress-nginx before v1.11.0; ingress-nginx v1.11.0 through v1.11.4; ingress-nginx v1.12.0
- **Fixed:** ingress-nginx v1.11.5; ingress-nginx v1.12.1
- **CVEs:** CVE-2025-1974, CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, CVE-2025-24513
- **CISA KEV:** no · **Exploitation:** Public proof-of-concept

## What to do

1. Find controllers: kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginx, and note the image tags.
2. Upgrade to ingress-nginx v1.11.5, v1.12.1 or any later release.
3. If you cannot upgrade, disable the validating admission webhook (Helm: controller.admissionWebhooks.enabled=false; manual: delete the ingress-nginx-admission ValidatingWebhookConfiguration and remove --validating-webhook), then re-enable it after upgrading.
4. Use NetworkPolicy so only the Kubernetes API server can reach the admission webhook port, and make sure it is never exposed to the internet.
5. Plan a migration to Gateway API or another ingress controller, since ingress-nginx stopped receiving releases after March 2026.

### How to check if you are affected

- List controller image versions across all clusters and compare them against v1.11.5 / v1.12.1.
- Check whether the admission webhook Service is reachable from workloads or from outside the cluster.
- Review controller pod logs and audit logs for unexpected AdmissionReview requests or nginx -t errors mentioning ssl_engine or unusual annotations; the Kubernetes advisory lists no known IoCs.

## What happened

On March 24, 2025, the Kubernetes Security Response Committee [announced fixes](https://kubernetes.io/blog/2025/03/24/ingress-nginx-cve-2025-1974/) for five vulnerabilities in ingress-nginx, the community ingress controller that it says runs in over 40% of Kubernetes clusters. Wiz Research, which found the bugs, named the set [IngressNightmare](https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities).

Three of the bugs are configuration injection flaws, each scored CVSS 8.8 (High): CVE-2025-24514 (auth-url annotation), CVE-2025-1097 (auth-tls-match-cn annotation) and CVE-2025-1098 (mirror annotations). On their own they require permission to create an Ingress object. [CVE-2025-24513](https://github.com/kubernetes/kubernetes/issues/131005) is a path traversal in the admission controller, scored 4.8. The critical one is [CVE-2025-1974](https://github.com/kubernetes/kubernetes/issues/131009) (CVSS 9.8). The validating admission webhook ran `nginx -t` against configuration built from the incoming request, so anyone who could reach the webhook over the pod network could deliver those injections with no credentials at all.

Wiz's chain worked like this. First, an attacker sends a crafted AdmissionReview straight to the webhook. The injected `ssl_engine` directive then loads a shared library that was smuggled in through NGINX's client-body temp file and is still reachable via `/proc`. The result is code execution in the controller pod. In a default install that pod can read every Secret in the cluster, which usually means full cluster takeover.

## Who is affected

Affected: ingress-nginx before v1.11.0, v1.11.0 through v1.11.4, and v1.12.0. Fixed: v1.11.5 and v1.12.1. The 1.10.x and older lines never received a patch. This is the `kubernetes/ingress-nginx` project, not the separate NGINX Ingress Controller from F5/NGINX Inc. To check whether you run it, use `kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginx`. No pods means you are not affected.

## Do you really need to act?

At disclosure Wiz estimated that about 43% of cloud environments were vulnerable, and it found over 6,500 clusters exposing vulnerable admission controllers to the public internet. Those clusters were at serious risk. For everyone else, the realistic attacker is something already inside: a compromised pod, a VPC neighbor, or a user on the corporate network. The Kubernetes post notes that in many setups the pod network is reachable from all of those. The CVSS attack-vector rating was [debated in the advisory thread](https://github.com/kubernetes/kubernetes/issues/131009) (Network vs. Adjacent), but either way no credentials are needed.

Exploit code is public. [Wiz's database](https://www.wiz.io/vulnerability-database/cve/cve-2025-1974) reports a public exploit and very high EPSS. As of the October 21, 2026 snapshot, none of the five CVEs is in CISA KEV, and we found no confirmed in-the-wild campaign in the sources we reviewed. Nineteen months on, most maintained clusters have upgraded. The open risk is forgotten clusters and pinned Helm charts. One more factor: Kubernetes [retired ingress-nginx](https://kubernetes.io/blog/2025/11/11/ingress-nginx-retirement/), and best-effort maintenance ended in March 2026, so any future bug will not be fixed.

## What to do now

1. Inventory every cluster with the `kubectl` selector above and record the image tags.
2. Upgrade to v1.11.5, v1.12.1 or later.
3. If you can't upgrade yet, disable the admission webhook. With Helm, set `controller.admissionWebhooks.enabled=false`. For manual installs, delete the `ingress-nginx-admission` ValidatingWebhookConfiguration and remove `--validating-webhook` from the controller args. Turn it back on after upgrading.
4. Restrict the webhook with NetworkPolicy so that only the API server can reach it.
5. Start migrating to Gateway API or another maintained controller.

## How to tell if you were hit

The Kubernetes advisory lists no known indicators of compromise. Ask security@kubernetes.io about suspected exploitation. Check whether the webhook Service was reachable from untrusted networks while you ran a vulnerable version. Review controller logs for AdmissionReview requests that did not come from the API server, and for `nginx -t` failures that mention `ssl_engine` or odd annotations. If exposure was plausible, rotate the Secrets the controller could read, which in default installs means all of them, and review recent RBAC and workload changes.

## Timeline

- Dec 31, 2024 — Wiz reports CVE-2025-1974 and CVE-2025-24514 to Kubernetes.
- Jan 21, 2025 — Last of the injection bugs (CVE-2025-1098) reported.
- Feb 20, 2025 — Config validation removed from the admission controller (internal fix for CVE-2025-1974).
- Mar 24, 2025 — Public disclosure; ingress-nginx v1.11.5 and v1.12.1 released.
- Nov 11, 2025 — Kubernetes announces ingress-nginx retirement; best-effort maintenance until March 2026.

## Sources

1. [Kubernetes Blog — Ingress-nginx CVE-2025-1974: What You Need to Know](https://kubernetes.io/blog/2025/03/24/ingress-nginx-cve-2025-1974/)
2. [Kubernetes GitHub — CVE-2025-1974: ingress-nginx admission controller RCE escalation](https://github.com/kubernetes/kubernetes/issues/131009)
3. [Kubernetes GitHub — CVE-2025-24513: auth secret file path traversal](https://github.com/kubernetes/kubernetes/issues/131005)
4. [Wiz Research — IngressNightmare: critical unauthenticated RCE vulnerabilities in ingress-nginx](https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities)
5. [Wiz — CVE-2025-1974 vulnerability database entry](https://www.wiz.io/vulnerability-database/cve/cve-2025-1974)
6. [Kubernetes Blog — Ingress NGINX Retirement: What You Need to Know](https://kubernetes.io/blog/2025/11/11/ingress-nginx-retirement/)

---
Source page: https://erroneo.us/security/briefs/ingressnightmare-ingress-nginx-cve-2025-1974/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt