CVE-2025-1974
ingress-nginx admission controller RCE escalation
Description
A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
INFO
Published Date :
March 25, 2025, 12:15 a.m.
Last Modified :
June 17, 2026, 8:40 a.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | CRITICAL | [email protected] |
Solution
- Update the ingress-nginx controller to the latest secure version.
- Restrict network access to the ingress-nginx controller.
- Review and limit controller access to sensitive Secrets.
Public PoC/Exploit Available at Github
CVE-2025-1974 has a 114 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-1974.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-1974 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-1974
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Command-line CVE checker for RHEL, AlmaLinux, and Rocky Linux packages: query by installed package version or CVE ID using Red Hat's official OVAL security feeds.
almalinux cli cve linux oval patch-management python redhat rhel rockylinux security security-tools sysadmin vulnerability-scanner
Python
Personal exploit library — verified CVE PoCs rewritten from scratch
Python
Educational, Dockerized reproductions of publicly disclosed 2025-2026 CVEs: root-cause analysis, attack flows, PoCs, detections, and patch analysis.
cve cybersecurity detection-engineering docker mitre-attack patch-diff poc security-research vulnerability-research
Makefile Dockerfile JavaScript Mermaid Python Shell Erlang HTML
Offensive Security Engineer · Threat Intelligence Researcher · CTF Author — GitHub profile.
offensive-security security application-security bug-bounty cve-research penetration-testing ctf-author ctf-developer cve-researcher ai-security llm-security
None
安全审计与CVE追踪 | Security Audit & CVE Tracking
Next-generation SAST combining Interval Type-2 Fuzzy Logic, AI verification, knowledge graphs, metamorphic testing, and counterfactual analysis for accurate security scanning.
ai application-security code-analysis cwe devsecops electron offline owasp rust sarif sast security security-scanner security-tools static-analysis static-code-analysis taint-analysis tree-sitter typescript vulnerability-scanner
Python Kotlin TypeScript Rust
None
Dockerfile Go Shell JavaScript HTML TypeScript
None
Production-grade Kubernetes monitoring app with a full DevSecOps pipeline - SAST, SCA, Cosign signing, KBOM scanning, and Falco runtime security on EKS.
Dockerfile Go
webwiki
252 standalone, live-validated CVE exploit PoCs (pure-Python stdlib) across web apps, AI/ML platforms and the Linux kernel; 75 in the CISA KEV catalog. For authorized security testing and education.
cve exploit penetration-testing poc security-research vulnerability cybersecurity ethical-hacking infosec rce red-team security appsec cisa-kev deserialization exploit-development proof-of-concept python
Python C
Automate penetration testing workflows using an AI-powered terminal.
bingai bingo bingo-game gambling gerador go gomodules gpt minecraft minecraft-datapack modules mongodb packages react socket-io typescript vanilla-js versioning workflow
Python PowerShell Shell
None
Shell
Community-maintained fork of kubernetes/ingress-nginx with NGINX 1.30.2
fork cve docker helm ingress ingress-controller kubernetes kubernetes-ingress load-balancer nginx nginx130 reverse-proxy security
Lua Makefile Shell Go Template Mustache Go Python Dockerfile HTML JavaScript
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-1974 vulnerability anywhere in the article.
-
Daily CyberSecurity
The Invisible Proxy: NGINX Hijacked for Silent SEO Poisoning
NGINX attack flow diagram showing how user requests are intercepted and routed through attacker-controlled servers | Image: Datadog Security Research A new campaign is targeting the backbone of the we ... Read more
-
Daily CyberSecurity
Critical Flaw in Wix’s New AI Platform Base44 Allowed Unauthorized Access to Private Enterprise Apps
Image: Wiz Research In a significant finding that highlights the risks associated with emerging AI development platforms, Wiz Research has uncovered a critical vulnerability in Base44, a popular vibe ... Read more
-
CrowdStrike.com
Kubernetes IngressNightmare Vulnerabilities: What You Need to Know
We would like to recognize Amit Serper, Travis Lowe, Tony Gore, Adrian Godoy, Mihai Vasilescu, Suraj Sahu, Pablo Ramos, Raj Jammalamadaka, Lacie Griffin, and Josh Grunzweig for their contributions in ... Read more
-
Cyber Security News
“IngressNightmare” Critical RCE Vulnerabilities in Kubernetes NGINX Clusters Let Attackers Gain Full Control
A recently discovered set of vulnerabilities, dubbed “IngressNightmare,” found in Ingress NGINX Controller, exposing clusters to unauthenticated remote code execution (RCE). Kubernetes dominates conta ... Read more
-
SentinelOne
IngressNightmare | Critical Unauthenticated RCE Vulnerabilities in Kubernetes Ingress NGINX
As more organizations adopt containerization, Kubernetes adoption is at an all-time high. A key component to any Kubernetes cluster is allowing and managing external traffic to the services organizati ... Read more
-
Daily CyberSecurity
KNIME Business Hub Hit by Critical Bugs, Including Hard-Coded Password and XSS Flaws
A recent security advisory from KNIME details several vulnerabilities affecting the KNIME Business Hub, a customer-managed KNIME Hub instance that provides access to Hub resources and allows for custo ... Read more
-
The Hacker News
⚡ Weekly Recap: Chrome 0-Day, IngressNightmare, Solar Bugs, DNS Tactics, and More
Threat Intelligence / Cybersecurity Every week, someone somewhere slips up—and threat actors slip in. A misconfigured setting, an overlooked vulnerability, or a too-convenient cloud tool becomes the p ... Read more
-
Cyber Security News
PoC Exploit Released for Ingress-NGINX Remote Code Execution Vulnerabilities
A proof-of-concept (PoC) exploit for a critical remote code execution vulnerability in Kubernetes Ingress-NGINX controllers, tracked as CVE-2025-1974. The vulnerability uncovered by WiZ affects the va ... Read more
-
The Cyber Express
Multiple CVEs Found in Ingress-NGINX—Patch Now to Prevent Cluster Compromise
A set of vulnerabilities have been identified in Ingress-NGINX Controller for Kubernetes, posing a risk to organizations relying on the affected versions. These vulnerabilities impact versions prior t ... Read more
-
Cyber Security News
CodeQLEAKED – GitHub Supply Chain Attack Allows Code Execution Using CodeQL Repositories
A significant vulnerability in GitHub’s CodeQL actions could have permitted attackers to execute malicious code across hundreds of thousands of repositories. The vulnerability, assigned CVE-2025-24362 ... Read more
-
Cybersecurity News
Researcher Drops PoC for 9.8 CVSS Ingress-NGINX CVE-2025-1974 Flaw in Kubernetes
A series of critical security vulnerabilities has been discovered in the Ingress-NGINX Controller for Kubernetes, posing a significant risk to Kubernetes deployments. Security researcher Jacob Sandum ... Read more
The following table lists the changes that have been made to the
CVE-2025-1974 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://github.com/kubernetes/ingress-nginx', 'vendor': 'kubernetes', 'modules': ['Validating Admission Controller'], 'product': 'ingress-nginx', 'versions': [{'status': 'affected', 'version': '0', 'versionType': 'semver', 'lessThanOrEqual': '1.11.4'}, {'status': 'affected', 'version': '1.12.0'}], 'defaultStatus': 'unaffected'}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2025-1974', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2025-03-27T03:55:20.340497Z'} -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Feb. 04, 2026
Action Type Old Value New Value Added Reference https://www.exploit-db.com/exploits/52475 -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 10, 2025
Action Type Old Value New Value Added Reference https://github.com/B1ack4sh/Blackash-CVE-2025-1974 -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 03, 2025
Action Type Old Value New Value Added Reference https://security.netapp.com/advisory/ntap-20250328-0008/ -
New CVE Received by [email protected]
Mar. 25, 2025
Action Type Old Value New Value Added Description A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.) Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-653 Added Reference https://https://github.com/kubernetes/kubernetes/issues/131009