Detections
Analytics
CVE-2025-1974
critical
Description
A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
From the Tenable Blog
CVE-2025-1097, CVE-2025-1098, CVE-2025-1974, CVE-2025-24513, CVE-2025-24514: Frequently Asked Questions About IngressNightmare
Published: 2025-03-25
Frequently asked questions about five vulnerabilities in the Ingress NGINX Controller for Kubernetes, collectively known as IngressNightmare.
References
https://www.cisa.gov/news-events/ics-advisories/icsa-25-100-05
https://www.theregister.com/2025/03/25/kubernetes_flaw_rce_risk/
https://thehackernews.com/2025/03/critical-ingress-nginx-controller.html
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-1974
https://cloud.google.com/support/bulletins/index#gcp-2025-013
https://aws.amazon.com/security/security-bulletins/AWS-2025-006/
Details
Published: 2025-03-25
Updated: 2025-03-27
Named Vulnerability: IngressNightmareNamed Vulnerability: Ingress Nightmare
Risk Information
CVSS v2
Base Score: 10
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Severity: Critical
CVSS v3
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: Critical
EPSS
EPSS: 0.81778
Vulnerability Watch
Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.
Vulnerability Being Monitored