1. Home
  2. Vulnerabilities
  3. CVE-2025-1974
9.8
CRITICAL CVSS 3.1
CVE-2025-1974
ingress-nginx admission controller RCE escalation
Description

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

INFO

Published Date :

March 25, 2025, 12:15 a.m.

Last Modified :

Nov. 10, 2025, 6:16 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]
Affected Products

The following products are affected by CVE-2025-1974 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Kubernetes ingress-nginx
: Total Affected Vendor : 1 | Products : 1
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 CRITICAL [email protected]
Solution
Update Kubernetes ingress-nginx controller to a version that addresses arbitrary code execution.
  • Update the ingress-nginx controller to the latest secure version.
  • Restrict network access to the ingress-nginx controller.
  • Review and limit controller access to sensitive Secrets.
Public PoC/Exploit Available at Github

CVE-2025-1974 has a 66 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-1974.

URL Resource
https://https://github.com/kubernetes/kubernetes/issues/131009
https://github.com/B1ack4sh/Blackash-CVE-2025-1974
https://security.netapp.com/advisory/ntap-20250328-0008/
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-1974 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-1974 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
buenhyden/hy-home-infra

None

Updated: 1 week, 5 days ago
0 stars 0 fork 0 watcher
Born at : Nov. 10, 2025, 5:18 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
I3r1h0n/IngressNightterror

My view on IngressNightmare vulnerability

Python Makefile C Shell

Updated: 2 weeks, 1 day ago
1 stars 0 fork 0 watcher
Born at : Nov. 2, 2025, 4:24 p.m. This repo has been linked 4 different CVEs too.
Profile Photo
iteride/CVE-2025-1974

None

Updated: 2 months ago
0 stars 0 fork 0 watcher
Born at : Sept. 23, 2025, 5:24 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
Shitcontrol666/ONRE-Toolkit-k8s

small toolkit written by AI, for fast security checks in your k8s cluster

Python Shell

Updated: 3 months ago
0 stars 0 fork 0 watcher
Born at : Aug. 17, 2025, 10:24 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
BiiTts/POC-IngressNightmare-CVE-2025-1974

None

Python C Shell

Updated: 3 months, 1 week ago
0 stars 0 fork 0 watcher
Born at : Aug. 10, 2025, 6:04 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
tuananh244/First_agent

None

Python PowerShell Shell Batchfile JavaScript

Updated: 3 months ago
0 stars 0 fork 0 watcher
Born at : Aug. 3, 2025, 6:22 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
flavio/sbom-merger

An unfinished experiment merging vulnerability reports produced by trivy and grype

Makefile Go

Updated: 3 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : July 28, 2025, 7:12 a.m. This repo has been linked 3 different CVEs too.
Profile Photo
yembors64632/cve_monitor_Public

None

Updated: 3 months, 1 week ago
1 stars 0 fork 0 watcher
Born at : July 23, 2025, 11:54 a.m. This repo has been linked 88 different CVEs too.
Profile Photo
Armand2002/Exploit-CVE-2025-1974-Lab

None

Updated: 4 months, 1 week ago
0 stars 0 fork 0 watcher
Born at : July 14, 2025, 1:46 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
alexander-rebai/test-sast-issues

None

C Java Kotlin Python Ruby TypeScript HCL Dockerfile Shell

Updated: 4 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : July 2, 2025, 9:40 a.m. This repo has been linked 2 different CVEs too.
Profile Photo
Lern0n/Lernon-POC

备份的漏洞库，3月开始我们来维护

Updated: 4 months, 1 week ago
2 stars 0 fork 0 watcher
Born at : June 30, 2025, 9:14 a.m. This repo has been linked 216 different CVEs too.
Profile Photo
tbc957/k8s

None

Updated: 4 months, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : June 30, 2025, 3:58 a.m. This repo has been linked 4 different CVEs too.
Profile Photo
B1ack4sh/Blackash-CVE-2025-1974

CVE-2025-1974

Makefile C Go

Updated: 4 months, 3 weeks ago
3 stars 0 fork 0 watcher
Born at : June 26, 2025, 9:24 a.m. This repo has been linked 4 different CVEs too.
Profile Photo
oLy0/Vulnerability

None

Updated: 5 months, 1 week ago
0 stars 0 fork 0 watcher
Born at : June 15, 2025, 2:32 a.m. This repo has been linked 216 different CVEs too.
Profile Photo
aninfosec/IngressNightmare

None

Python C

Updated: 5 months, 1 week ago
0 stars 0 fork 0 watcher
Born at : June 14, 2025, 5:49 p.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-1974 vulnerability anywhere in the article.

  • Daily CyberSecurity
Critical Flaw in Wix’s New AI Platform Base44 Allowed Unauthorized Access to Private Enterprise Apps

Image: Wiz Research In a significant finding that highlights the risks associated with emerging AI development platforms, Wiz Research has uncovered a critical vulnerability in Base44, a popular vibe ... Read more

Published Date: Jul 30, 2025 (3 months, 3 weeks ago)
  • CrowdStrike.com
Kubernetes IngressNightmare Vulnerabilities: What You Need to Know

We would like to recognize Amit Serper, Travis Lowe, Tony Gore, Adrian Godoy, Mihai Vasilescu, Suraj Sahu, Pablo Ramos, Raj Jammalamadaka, Lacie Griffin, and Josh Grunzweig for their contributions in ... Read more

Published Date: Apr 23, 2025 (7 months ago)
  • Cyber Security News
“IngressNightmare” Critical RCE Vulnerabilities in Kubernetes NGINX Clusters Let Attackers Gain Full Control

A recently discovered set of vulnerabilities, dubbed “IngressNightmare,” found in Ingress NGINX Controller, exposing clusters to unauthenticated remote code execution (RCE). Kubernetes dominates conta ... Read more

Published Date: Apr 05, 2025 (7 months, 2 weeks ago)
  • SentinelOne
IngressNightmare | Critical Unauthenticated RCE Vulnerabilities in Kubernetes Ingress NGINX

As more organizations adopt containerization, Kubernetes adoption is at an all-time high. A key component to any Kubernetes cluster is allowing and managing external traffic to the services organizati ... Read more

Published Date: Apr 04, 2025 (7 months, 2 weeks ago)
  • Daily CyberSecurity
KNIME Business Hub Hit by Critical Bugs, Including Hard-Coded Password and XSS Flaws

A recent security advisory from KNIME details several vulnerabilities affecting the KNIME Business Hub, a customer-managed KNIME Hub instance that provides access to Hub resources and allows for custo ... Read more

Published Date: Apr 01, 2025 (7 months, 3 weeks ago)
  • The Hacker News
⚡ Weekly Recap: Chrome 0-Day, IngressNightmare, Solar Bugs, DNS Tactics, and More

Threat Intelligence / Cybersecurity Every week, someone somewhere slips up—and threat actors slip in. A misconfigured setting, an overlooked vulnerability, or a too-convenient cloud tool becomes the p ... Read more

Published Date: Mar 31, 2025 (7 months, 3 weeks ago)
  • Cyber Security News
PoC Exploit Released for Ingress-NGINX Remote Code Execution Vulnerabilities

A proof-of-concept (PoC) exploit for a critical remote code execution vulnerability in Kubernetes Ingress-NGINX controllers, tracked as CVE-2025-1974. The vulnerability uncovered by WiZ affects the va ... Read more

Published Date: Mar 27, 2025 (7 months, 3 weeks ago)
  • The Cyber Express
Multiple CVEs Found in Ingress-NGINX—Patch Now to Prevent Cluster Compromise

A set of vulnerabilities have been identified in Ingress-NGINX Controller for Kubernetes, posing a risk to organizations relying on the affected versions. These vulnerabilities impact versions prior t ... Read more

Published Date: Mar 27, 2025 (7 months, 3 weeks ago)
  • Cyber Security News
CodeQLEAKED – GitHub Supply Chain Attack Allows Code Execution Using CodeQL Repositories

A significant vulnerability in GitHub’s CodeQL actions could have permitted attackers to execute malicious code across hundreds of thousands of repositories. The vulnerability, assigned CVE-2025-24362 ... Read more

Published Date: Mar 27, 2025 (7 months, 3 weeks ago)
  • Cybersecurity News
Researcher Drops PoC for 9.8 CVSS Ingress-NGINX CVE-2025-1974 Flaw in Kubernetes

A series of critical security vulnerabilities has been discovered in the Ingress-NGINX Controller for Kubernetes, posing a significant risk to Kubernetes deployments. Security researcher Jacob Sandum ... Read more

Published Date: Mar 27, 2025 (7 months, 4 weeks ago)

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2025-1974 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 10, 2025

    Action Type Old Value New Value
    Added Reference https://github.com/B1ack4sh/Blackash-CVE-2025-1974
  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 03, 2025

    Action Type Old Value New Value
    Added Reference https://security.netapp.com/advisory/ntap-20250328-0008/
  • New CVE Received by [email protected]

    Mar. 25, 2025

    Action Type Old Value New Value
    Added Description A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
    Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Added CWE CWE-653
    Added Reference https://https://github.com/kubernetes/kubernetes/issues/131009
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Vulnerability Scoring Details
Base CVSS Score: 9.8
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact