Mar 24, 2025

Started

• Closed✓Patched

  IngressNightmare: unauthenticated RCE in Kubernetes ingress-nginx admission controller (CVE-2025-1974)

  Wiz found that the ingress-nginx admission webhook could be made to load attacker config and run code, giving access to all cluster secrets the controller can read. CVSS 9.8. Fixed in controller v1.12.1 and v1.11.5; otherwise disable the validating webhook.

  Kubernetes ingress-nginx controller·Closed Mar 24, 2025·updated Mar 24, 2025

• Closed✓Patched

  reviewdog action-setup GitHub Action: reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability

  reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs. Added to CISA KEV on 2025-03-24.

  reviewdog action-setup GitHub Action·Closed Mar 24, 2025·updated Mar 24, 2025