cyber.hendryadrian.com
Threat Research · wiz.io

IngressNightmare Flaws Enable Unauthenticated RCE in Kubernetes Ingress NGINX

· Original article ↗

Summary

Wiz researchers detailed four Ingress NGINX flaws that can enable unauthenticated RCE and access to Kubernetes secrets. They reported more than 6,500 publicly exposed clusters; fixes are available in versions 1.12.1 and 1.11.5.

Key points

  • The four flaws are CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, and CVE-2025-1974; the article says CVE-2025-24513 is separate and does not lead to RCE.
  • The attack targets Ingress NGINX’s unauthenticated admission controller, which processes AdmissionReview requests and generates NGINX configuration.
  • Researchers showed how crafted ingress data can inject NGINX directives; they used the `ssl_engine` directive and a shared library staged through NGINX client-body buffering to achieve code execution.
  • The controller’s permissions can expose secrets across Kubernetes namespaces, creating a potential path to cluster takeover.
  • Wiz reported that about 43% of cloud environments were vulnerable and that its research found over 6,500 clusters with publicly exposed vulnerable admission controllers.
  • The article recommends upgrading to Ingress NGINX Controller 1.12.1 or 1.11.5, restricting external access to the admission webhook, or using network policies or temporary webhook disablement if upgrading is not immediate.
  • A later article update says ingress-nginx was declared EOL on November 12, 2025, and advises migrating to Gateway API or another ingress controller.

Article Details

Attack Vectors
  • An attacker with network access to the unauthenticated Ingress NGINX admission controller can send a crafted AdmissionReview request containing an Ingress object.
  • CVE-2025-24514 and CVE-2025-1097 allow unsanitized auth-url or auth-tls-match-cn annotation values to inject NGINX directives into the temporary configuration.
  • CVE-2025-1098 allows arbitrary NGINX directive injection through the Ingress object's UID field.
  • The injected ssl_engine directive can load a shared library from a file descriptor in ProcFS while nginx -t validates the configuration. The article describes placing the library in a temporary file using NGINX client-body buffering.
  • Code execution in the controller pod can expose Kubernetes secrets across namespaces through the pod's highly privileged role, potentially enabling cluster takeover.
Defensive Notes
  • Upgrade Ingress NGINX Controller to version 1.12.1 or 1.11.5, which the article identifies as fixed versions.
  • Do not expose the admission webhook endpoint externally; use strict network policies so only the Kubernetes API Server can access it.
  • If an immediate upgrade is not possible, temporarily disable the admission controller, then re-enable it after upgrading.
  • Use the article's Nuclei template to check for exposed admission controllers and monitor ingress traffic for malicious AdmissionReview requests and anomalous library loads.
  • The article recommends migrating to the Gateway API or another Ingress Controller as Ingress NGINX approaches retirement.

MITRE ATT&CK

T1105 · Ingress Tool TransferThe exploit uploads a shared-library payload to the controller pod by sending it in an HTTP request body that NGINX client-body buffering writes to a temporary file.T1129 · Shared ModulesThe injected ssl_engine directive loads the uploaded shared library during nginx -t configuration validation.T1190 · Exploit Public-Facing ApplicationThe described exploit sends crafted requests to the network-accessible Ingress NGINX admission controller to exploit its vulnerabilities.T1552.007 · Container APIThe article says code execution in the controller pod can use its Kubernetes role to access secrets across cluster namespaces.

CVE

CVE-2025-1097Wiz Research discovered CVE-2025-1097, CVE-2025-1098, CVE-2025-24514 and CVE-2025-1974, a series of unauthenticated Remote Code Execution vulnerabilities in Ingress NGINX Controller for Kubernetes dubbedCVE-2025-1098Wiz Research discovered CVE-2025-1097, CVE-2025-1098, CVE-2025-24514 and CVE-2025-1974, a series of unauthenticated Remote Code Execution vulnerabilities in Ingress NGINX Controller for Kubernetes dubbedCVE-2025-1974Wiz Research discovered CVE-2025-1097, CVE-2025-1098, CVE-2025-24514 and CVE-2025-1974, a series of unauthenticated Remote Code Execution vulnerabilities in Ingress NGINX Controller for Kubernetes dubbedCVE-2025-24514Wiz Research discovered CVE-2025-1097, CVE-2025-1098, CVE-2025-24514 and CVE-2025-1974, a series of unauthenticated Remote Code Execution vulnerabilities in Ingress NGINX Controller for Kubernetes dubbed

People

Andres RianchoWiz Research team member named in the article about the vulnerability research.Hillai Ben-SassonWiz Research team member named in the article about the vulnerability research.Marco EbertIngress-NGINX maintainer thanked for helping address the vulnerabilities.Nir OhfeldWiz Research team member named in the article about the vulnerability research.Ronen ShustinWiz Research team member named in the article about the vulnerability research.Sagi TzadikWiz Research team member named in the article about the vulnerability research.

Vendors

WizWiz Research discovered CVE-2025-1097, CVE-2025-1098, CVE-2025-24514 and CVE-2025-1974, a series of unauthenticated Remote Code Execution vulnerabilities in Ingress NGINX Controller for Kubernetes dubbed

Products

Kubernetesa series of unauthenticated Remote Code Execution vulnerabilities in Ingress NGINX Controller for Kubernetes dubbed #IngressNightmare. Exploitation of these vulnerabilities leads to unauthorized access to allKubernetes ingress-nginxand CVE-2025-1974, a series of unauthenticated Remote Code Execution vulnerabilities in Ingress NGINX Controller for Kubernetes dubbed #IngressNightmare. Exploitation of these vulnerabilities leads toNGINXand CVE-2025-1974, a series of unauthenticated Remote Code Execution vulnerabilities in Ingress NGINX Controller for Kubernetes dubbed #IngressNightmare. Exploitation of these vulnerabilities leads toWiz Dynamic Scanneradvisory in the Wiz Threat Center. Wiz also validates for exposed admission controllers using the Wiz Dynamic Scanner. Finally, the Wiz Runtime Sensor detects zero-day vulnerabilities like IngressNightmare, byWiz Runtime SensorWiz also validates for exposed admission controllers using the Wiz Dynamic Scanner. Finally, the Wiz Runtime Sensor detects zero-day vulnerabilities like IngressNightmare, by continuously monitoring ingress traffic,

Tools

kube-reviewFor our testing, we used kube-review to create admission review requests from Ingress resource manifests, which could then be sent directly to the admission controller via HTTP.NucleiYou can use this Nuclei template to check for exposed Ingress-NGINX admission controllers. 

Related Articles