wiz · Crawled Jul 25, 2026

CVE-2025-1974: The IngressNightmare in Kubernetes | Wiz Blog

7 IoCs 5 CVEs

AI Summary

Wiz Research discovered a series of critical unauthenticated Remote Code Execution (RCE) vulnerabilities in Ingress NGINX Controller for Kubernetes, collectively dubbed IngressNightmare. These vulnerabilities (CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, and CVE-2025-1974) allow attackers to inject malicious NGINX configurations and achieve remote code execution on the ingress controller pod, leading to full cluster compromise. The admission controller, which is exposed without authentication by default, enables exploitation by processing untrusted admission review requests. Over 43% of cloud environments are estimated to be vulnerable, with more than 6,500 clusters already exposed to the public internet.

AI-extracted · verify before operational use

Extracted Entities 5 found

CVE CVE-2025-1097 → CVE CVE-2025-1098 → CVE CVE-2025-24514 → CVE CVE-2025-1974 → CVE CVE-2025-24513 →

Indicators of Compromise 7 extracted

Type	Value	Detail
GitHub Repo	ingress-nginx	Details →
GitHub User	andresriancho	Details →
GitHub User	ronenshh	Details →
GitHub User	sagitz_	Details →
GitHub User	nirohfeld	Details →
GitHub User	hillai	Details →
Registry User	wiz_io	Details →

MITRE ATT&CK TTPs 19 techniques

T1055 Process Injection · Defense Evasion T1059.004 Unix Shell · Execution T1068 Exploitation for Privilege Escalation · Privilege Escalation T1071.001 Web Protocols · Command And Control T1190 Exploit Public-Facing Application · Initial Access T1212 Exploitation for Credential Access · Credential Access T1484 Domain or Tenant Policy Modification · Defense Evasion T1003 OS Credential Dumping · Credential Access T1018 Remote System Discovery · Discovery T1021.004 SSH · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1048 Exfiltration Over Alternative Protocol · Exfiltration T1057 Process Discovery · Discovery T1059.001 PowerShell · Execution T1078 Valid Accounts · Defense Evasion T1083 File and Directory Discovery · Discovery T1133 External Remote Services · Persistence T1210 Exploitation of Remote Services · Lateral Movement T1496 Resource Hijacking · Impact