CVE-2025-24514

Published Mar 25, 2025

Last updated 3 months ago

CVSS high 8.8

Kubernetes

IngressNightmare

NGINX

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-24514 is one of several critical vulnerabilities collectively named "IngressNightmare" found in the Ingress NGINX Controller for Kubernetes. This vulnerability exists in the admission controller component, which is responsible for validating incoming ingress objects. The admission controllers are accessible over the network without authentication. By sending a malicious ingress object directly to the admission controller, an attacker can inject an arbitrary NGINX configuration remotely. This leads to code execution on the Ingress NGINX Controller's pod, potentially granting unauthorized access to all secrets stored across all namespaces in the Kubernetes cluster, and possibly leading to complete cluster takeover.

Description: A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Source: jordan@liggitt.net
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

jordan@liggitt.net: CWE-20

Hype score: Not currently trending

References