CVE-2025-1974
ingress-nginx admission controller RCE escalation
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
ingress-nginx admission controller RCE escalation
A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Reserved 2025-03-04 | Published 2025-03-24 | Updated 2025-03-27 | Assigner kubernetesCWE-653 Improper Isolation or Compartmentalization
Nir Ohfeld
Ronen Shustin
Sagi Tzadik
Hillai Ben Sasson
https//github.com/kubernetes/kubernetes/issues/131009
Support options
