CVE-2025-1974: ingress-nginx admission controller RCE escalation

Should you act?

High exploit likelihood

EPSS ranks it in the top 5% of all CVEs for likely exploitation in the next 30 days. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
• EPSS 99.4%, percentile 99.9: FIRST’s model estimates a 99.4% chance of exploitation activity in the next 30 days, higher than 99.9% of all scored CVEs (very high). EPSS is a probability, not a verdict.
• Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
• Only applies if your dependency tree includes k8s.io/ingress-nginx (Go) < 1.11.5, fixed in 1.11.5; k8s.io/ingress-nginx (Go) >= 1.12.0-beta.0, < 1.12.1, fixed in 1.12.1. Check your lockfile, including transitive dependencies.
• Editorial verdict: Check exposure. IngressNightmare: ingress-nginx Cluster Takeover RCE — Patched since March 2025. If any cluster still runs ingress-nginx below 1.11.5 or 1.12.1, that is a cluster-takeover risk, and the controller itself is now retired, so plan the migration while you check.

What it is

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

From the GitHub advisory

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

Weakness type: CWE-653.

Product: k8s.io/ingress-nginx (Go) · Assigned by: kubernetes · Published: 2025-03-24

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Privileges required: none (no login)
• User interaction: none
• Scope: unchanged

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation poc, automatable yes, technical impact total.
• FIRST EPSS (model of 2026-10-21): 99.38% probability of exploitation activity in the next 30 days; percentile 99.9.

Timeline

• 2025-03-24 — CVE record published by kubernetes
• 2025-03-24 — erroneo.us brief: IngressNightmare: ingress-nginx Cluster Takeover RCE
• 2025-03-25 — GitHub-reviewed advisory GHSA-mgvx-rpfc-9mpv published (critical)
• 2026-02-26 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-mgvx-rpfc-9mpv github.com
2. CVE.org record CVE-2025-1974 cve.org
3. NVD entry CVE-2025-1974 nvd.nist.gov

Other references from the CVE record and advisory

1. https: https:
2. security.netapp.com security.netapp.com
3. github.com github.com
4. exploit-db.com exploit-db.com
5. github.com github.com
6. github.com github.com
7. github.com github.com
8. groups.google.com groups.google.com

Critical Go advisories · Today’s Security Digest