🔐 CVE Alert

CVE-2025-1974

CRITICAL 9.8

ingress-nginx admission controller RCE escalation

CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

CWE CWE-653
Vendor kubernetes
Product ingress-nginx
Ecosystems
Industries
Technology
Published Mar 24, 2025
Last Updated Feb 26, 2026
Stay Ahead of the Next One

Get instant alerts for kubernetes ingress-nginx

Be the first to know when new critical vulnerabilities affecting kubernetes ingress-nginx are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Affected Versions

kubernetes / ingress-nginx
0 ≤ 1.11.4 1.12.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗
https: https://https://github.com/kubernetes/kubernetes/issues/131009 security.netapp.com: https://security.netapp.com/advisory/ntap-20250328-0008/ github.com: https://github.com/B1ack4sh/Blackash-CVE-2025-1974 exploit-db.com: https://www.exploit-db.com/exploits/52475

Credits

Nir Ohfeld Ronen Shustin Sagi Tzadik Hillai Ben Sasson