# IngressNightmare: unauthenticated RCE in Kubernetes ingress-nginx admission controller (CVE-2025-1974) · pwn.watch

> Wiz found that the ingress-nginx admission webhook could be made to load attacker config and run code, giving access to all cluster secrets the controller can read. CVSS 9.8. Fixed in controller v1.12.1 and v1.11.5; otherwise disable the validating webhook.

Page: https://pwn.watch/i/ingressnightmare-ingress-nginx-cve-2025-1974 · generated 2026-10-23T00:16:28.879Z

## Status
- Severity: critical · status: closed · patch: patched
- Product: Kubernetes ingress-nginx controller
- Started: 2025-03-24 · closed: 2025-03-24
- CVEs: CVE-2025-1974
- Affected: < 1.11.0; 1.11.0-1.11.4; 1.12.0
- Fixed in: 1.11.5; 1.12.1

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/ingressnightmare-ingress-nginx-cve-2025-1974/feed.xml
- JSON Feed: https://pwn.watch/i/ingressnightmare-ingress-nginx-cve-2025-1974/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/ingressnightmare-ingress-nginx-cve-2025-1974.json
- This file: https://pwn.watch/i/ingressnightmare-ingress-nginx-cve-2025-1974/llms.txt

## Updates (newest first)
- 2025-03-24: Kubernetes publishes advisory and fixed controller releases; Wiz publishes IngressNightmare (https://kubernetes.io/blog/2025/03/24/ingress-nginx-cve-2025-1974/)

## Fix brief
# Security brief: IngressNightmare: unauthenticated RCE in Kubernetes ingress-nginx admission controller (CVE-2025-1974)

Source: https://pwn.watch/i/ingressnightmare-ingress-nginx-cve-2025-1974 · status: closed (closed Mar 24, 2025) · severity: critical · updated Mar 24, 2025

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Wiz found that the ingress-nginx admission webhook could be made to load attacker config and run code, giving access to all cluster secrets the controller can read. CVSS 9.8. Fixed in controller v1.12.1 and v1.11.5; otherwise disable the validating webhook.

Severity detail: CVSS 9.8; unauthenticated RCE from the pod network

- Product: Kubernetes ingress-nginx controller
- CVE / advisory ids: CVE-2025-1974

## Affected versions
- < 1.11.0
- 1.11.0-1.11.4
- 1.12.0

## Check whether you're affected
Run these where the product is installed or in the project that depends on it, then compare with the affected/fixed versions:

```sh
nginx -v
```

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- 1.11.5
- 1.12.1

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- Mar 24, 2025: Kubernetes publishes advisory and fixed controller releases; Wiz publishes IngressNightmare

## Advisories
- [Ingress-nginx CVE-2025-1974: What You Need to Know](https://kubernetes.io/blog/2025/03/24/ingress-nginx-cve-2025-1974/) (Kubernetes)
- [[Security Advisory] Multiple vulnerabilities in ingress-nginx](https://groups.google.com/g/kubernetes-security-announce/c/2qa9DFtN0cQ) (Kubernetes Security Announce)
- [controller-v1.12.1](https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.12.1) (Kubernetes)
- [NVD: CVE-2025-1974](https://nvd.nist.gov/vuln/detail/CVE-2025-1974) (NVD)

## Write-ups & news
- [CVE-2025-1974: The IngressNightmare in Kubernetes](https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities)

---
Machine-readable: https://pwn.watch/i/ingressnightmare-ingress-nginx-cve-2025-1974.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.