NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · Go

CVE-2025-1974: ingress-nginx admission controller RCE escalation

criticalCVSS 3.1 9.8GHSA-mgvx-rpfc-9mpv

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

Published Mar 25, 2025 · Updated Feb 4, 2026

Affected packages

k8s.io/ingress-nginx

Ecosystem
Go
Affected
< 1.11.5
Fixed in
1.11.5
Check
go list -m k8s.io/ingress-nginx

k8s.io/ingress-nginx

Ecosystem
Go
Affected
>= 1.12.0-beta.0, < 1.12.1
Fixed in
1.12.1
Check
go list -m k8s.io/ingress-nginx

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

Credited to dor-hayun.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology