{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "IngressNightmare: unauthenticated RCE in Kubernetes ingress-nginx admission controller (CVE-2025-1974) · updates",
  "home_page_url": "https://pwn.watch/i/ingressnightmare-ingress-nginx-cve-2025-1974",
  "feed_url": "https://pwn.watch/i/ingressnightmare-ingress-nginx-cve-2025-1974/feed.json",
  "description": "Wiz found that the ingress-nginx admission webhook could be made to load attacker config and run code, giving access to all cluster secrets the controller can read. CVSS 9.8. Fixed in controller v1.12.1 and v1.11.5; otherwise disable the validating webhook.",
  "language": "en",
  "_pwn": {
    "slug": "ingressnightmare-ingress-nginx-cve-2025-1974",
    "severity": "critical",
    "status": "closed",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/ingressnightmare-ingress-nginx-cve-2025-1974/feed.xml",
    "llms": "https://pwn.watch/i/ingressnightmare-ingress-nginx-cve-2025-1974/llms.txt",
    "json": "https://pwn.watch/i/ingressnightmare-ingress-nginx-cve-2025-1974.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/ingressnightmare-ingress-nginx-cve-2025-1974#2025-03-24-fd2f2768",
      "url": "https://pwn.watch/i/ingressnightmare-ingress-nginx-cve-2025-1974#2025-03-24-fd2f2768",
      "title": "IngressNightmare: unauthenticated RCE in Kubernetes ingress-nginx admission controller (CVE-2025-1974): Kubernetes publishes advisory and fixed controller releases; Wiz publishes IngressNightmare",
      "content_text": "IngressNightmare: unauthenticated RCE in Kubernetes ingress-nginx admission controller (CVE-2025-1974): Kubernetes publishes advisory and fixed controller releases; Wiz publishes IngressNightmare\n\nSource: https://kubernetes.io/blog/2025/03/24/ingress-nginx-cve-2025-1974/",
      "date_published": "2025-03-24T00:00:00.000Z",
      "external_url": "https://kubernetes.io/blog/2025/03/24/ingress-nginx-cve-2025-1974/",
      "tags": [
        "critical"
      ]
    }
  ]
}