CVE-2025-1098

Published Mar 25, 2025

Last updated a day ago

CVSS high 8.8

Kubernetes

IngressNightmare

NGINX

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-1098 is one of five critical vulnerabilities disclosed in the Ingress NGINX Controller for Kubernetes. These vulnerabilities, collectively named "IngressNightmare," could lead to unauthenticated remote code execution. The vulnerability affects the admission controller component and allows attackers to inject arbitrary Nginx configurations by sending malicious ingress objects. This can result in code execution on the Ingress NGINX Controller's pod and unauthorized access to all secrets stored across all namespaces in the Kubernetes cluster, potentially leading to a complete cluster takeover.

Description: A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Source: jordan@liggitt.net
NVD status: Received

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

jordan@liggitt.net: CWE-20

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 34

Overview

AI description

Risk scores

CVSS 3.1

Weaknesses

Social media

References