CVE-2025-1974 in ingress-nginx (IngressNightmare)
Summary
by MITRE • 03/25/2025
A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 01/17/2026
This vulnerability resides within the Kubernetes ingress-nginx controller implementation and represents a critical authorization bypass flaw that enables unauthenticated attackers to execute arbitrary code within the controller's operational context. The security issue manifests when an attacker gains access to the pod network and can leverage specific conditions to escalate privileges and achieve code execution. The flaw operates at the intersection of network access control and privilege management within containerized environments, creating a pathway for attackers to compromise the controller's security boundaries.
The technical mechanism behind this vulnerability involves the ingress-nginx controller's handling of network requests and its interaction with the underlying Kubernetes API. When an attacker can communicate with the controller through the pod network, they can exploit specific request processing behaviors to inject malicious code that executes with the controller's privileges. This execution context provides access to the controller's operational environment, which in default configurations has broad cluster-wide access to Kubernetes Secrets. The vulnerability essentially undermines the principle of least privilege by allowing network-based attackers to bypass authentication mechanisms and gain elevated execution capabilities.
The operational impact of this vulnerability extends beyond simple code execution to encompass complete data exfiltration capabilities. Since the ingress-nginx controller in default installations can access all cluster Secrets, successful exploitation enables attackers to retrieve sensitive information including database credentials, API keys, and other confidential data stored in the cluster. This represents a severe compromise of the cluster's confidentiality and integrity, potentially affecting all applications and services that rely on these secrets for authentication and authorization. The vulnerability creates a persistent threat vector that can be exploited repeatedly, as network access to the pod network often requires minimal privileges.
Mitigation strategies must address both the immediate exploitation conditions and the underlying architectural issues. Organizations should implement network segmentation to restrict access to pod networks and deploy network policies that limit communication between pods. The controller should be configured with minimal necessary permissions and access controls should be enforced through proper RBAC configurations. Regular security audits and monitoring for unusual network traffic patterns can help detect exploitation attempts. Additionally, organizations should consider implementing network-level protections such as ingress firewalls and ensure that default controller configurations are reviewed and hardened according to security best practices. This vulnerability aligns with CWE-284 (Improper Access Control) and represents a significant concern under the ATT&CK framework's privilege escalation and credential access tactics.