IngressNightmare is a collection of five vulnerabilities affecting the Ingress NGINX Controller for Kubernetes. These vulnerabilities were publicly disclosed on March 24th, 2025. The vulnerabilities include configuration injection and remote code execution flaws. Severity varies, with one critical and three high-severity vulnerabilities identified. The most severe flaw allows unauthenticated access to the admission controller. These vulnerabilities can be chained together, potentially leading to cluster takeover through secret access. There were no zero-day exploits, and the vulnerabilities were reported through coordinated disclosure. As of the disclosure date, no public proof-of-concept exploits were available. Fixed versions of the Ingress NGINX Controller were released on March 24th. The vulnerabilities do not impact the NGINX Ingress Controller from F5. Tenable is providing product coverage through plugins for these CVEs.

Origin

Origin

Origin

Origin

Learn about CVE-2025-1974 and the IngressNightmare threat that could allow unauthorized access in Kubernetes clusters.

Wiz recently published a detailed analysis of a critical vulnerability in the NGINX Ingress admission controller—what they’ve dubbed IngressNightmare (CVE-2025-1097, CVE-2025-1098, CVE-2025-1974, CVE-2025-24514). The vulnerability stems from insufficient input validation during configuration file processing, allowing an attacker to inject arbitrary code into the NGINX process. Wiz’s writeup is excellent and covers the technical nuances thoroughly, […]