Five severe security vulnerabilities have been discovered in the Ingress NGINX Controller for Kubernetes, potentially exposing over 6,500 clusters to unauthenticated remote code execution attacks. Collectively named “IngressNightmare” by cloud security firm Wiz, these flaws carry a critical CVSS score of 9.8.
## The Vulnerability Impact
The vulnerabilities (CVE-2025-24513, CVE-2025-24514, CVE-2025-1097, CVE-2025-1098, and CVE-2025-1974) affect the admission controller component of Ingress NGINX Controller. Approximately 43% of cloud environments are vulnerable to these flaws.
“Exploitation leads to unauthorized access to all secrets stored across all namespaces in the Kubernetes cluster, which can result in cluster takeover,” Wiz researchers explained.
## Technical Details
The vulnerabilities exploit the fact that admission controllers are accessible over the network without authentication. Attackers can inject arbitrary NGINX configurations by sending malicious ingress objects directly to the admission controller, resulting in code execution on the controller’s pod.
The specific vulnerabilities include:
– **CVE-2025-24513** (CVSS 4.8): Input validation flaw enabling directory traversal
– **CVE-2025-24514** (CVSS 8.8): Auth-url annotation can be exploited for configuration injection
– **CVE-2025-1097** (CVSS 8.8): Auth-tls-match-cn annotation vulnerability
– **CVE-2025-1098** (CVSS 8.8): Mirror-target and mirror-host annotations can be exploited
– **CVE-2025-1974** (CVSS 9.8): Unauthenticated attackers can achieve arbitrary code execution
## Attack Scenario
In a typical attack, threat actors could upload malicious payloads as shared libraries using NGINX’s client-body buffer feature, then send an AdmissionReview request containing configuration directive injections. This causes the shared library to load, enabling remote code execution and potentially full cluster takeover.
## Remediation
These vulnerabilities have been patched in Ingress NGINX Controller versions 1.12.1, 1.11.5, and 1.10.7. Users should:
1. Update to the latest version immediately
2. Ensure admission webhook endpoints aren’t exposed externally
3. Limit access to the admission controller to only the Kubernetes API Server
4. Temporarily disable the admission controller if not needed
Note that these vulnerabilities do not affect the separate NGINX Ingress Controller implementation for NGINX and NGINX Plus.