A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.

We are monitoring a series of vulnerabilities in the Ingress NGINX Controller for Kubernetes, dubbed IngressNightmare. Organizations are advised to apply available patches.

The version of Ingres-NGINX controller installed on the remote host is prior to 1.11.5/1.12.1. It is, therefore, affected by multiple vulnerabilities as referenced as Ingress Nightmare.

  - A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with     access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This     can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the     controller can access all Secrets cluster-wide.) (CVE-2025-1974)

  - A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the     `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx.     This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets     accessible to the controller. (Note that in the default installation, the controller can access     all Secrets cluster-wide.) (CVE-2025-1098)   
  - A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the     `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary     code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the     controller. (Note that in the default installation, the controller can access     all Secrets cluster-wide.) (CVE-2025-1097)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where
    attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature,
    resulting in directory traversal within the container. This could result in denial of service, or when
    combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.
    (CVE-2025-24513)

ID	Name	Product	Family	Severity
233357	Ingress-NGINX controller < 1.11.5 / 1.12 < 1.12.1 Multiple Vulnerabilities	Nessus	Misc.	critical
421230	SCA: security update for k8s.io/ingress-nginx (GHSA-242m-6h72-7hgp)	Tenable Cloud Security	SCA Checks	medium
421230	SCA: security update for k8s.io/ingress-nginx (GHSA-242m-6h72-7hgp)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2025-24513

medium

Tenable Plugins

critical

medium

medium