CVE

CVE-2025-1097

View on NVD ↗

ingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation

Exploitation IoCs 7

GitHub Repo ingress-nginx

GitHub User andresriancho

GitHub User hillai

GitHub User nirohfeld

GitHub User ronenshh

GitHub User sagitz_

Registry User wiz_io

MITRE ATT&CK TTPs 7

Process Injection

Defense Evasion

Exploitation for Privilege Escalation

Privilege Escalation

Command And Control

Exploit Public-Facing Application

Exploitation for Credential Access

Credential Access

Domain or Tenant Policy Modification

Defense Evasion

Source Articles

CVE-2025-1974: The IngressNightmare in Kubernetes | Wiz Blog

Wiz Research discovered a series of critical unauthenticated Remote Code Execution (RCE) vulnerabilities in Ingress NGINX Controller for Kubernetes, collectively dubbed IngressNightmare. These vulnerabilities (CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, and CVE-2025-1974) allow attackers to inject malicious NGINX configurations and achieve remote code execution on the ingress controller pod, leading to full cluster compromise. The admission controller, which is exposed without authentication by default, enables exploitation by processing untrusted admission review requests. Over 43% of cloud environments are estimated to be vulnerable, with more than 6,500 clusters already exposed to the public internet.