CVE-2025-1097

CVE-2025-1097 is a configuration injection flaw (CWE-20) in the Kubernetes ingress-nginx controller: values of the auth-tls-match-cn Ingress annotation are not properly sanitized, so an attacker who can create or modify Ingress resources can inject arbitrary nginx configuration directives. On configuration reload, the injected directives are interpreted by nginx, which can be escalated to arbitrary code execution in the context of the ingress-nginx controller. An attacker with code execution in the controller can also read Secrets accessible to it, and in a default installation the controller can access all Secrets cluster-wide, enabling broader cluster compromise. Any cluster running a vulnerable ingress-nginx controller is affected, with the greatest risk where untrusted or multi-tenant users hold rights to apply Ingress annotations or where controller pods are internet-exposed. Per the available data there is no confirmed in-the-wild exploitation or public PoC yet, but EPSS assigns a 35.5% probability of exploitation within 30 days (98th percentile), and the flaw is part of the "IngressNightmare" group of bugs reported to affect roughly 40% of cloud environments.

What to do: Upgrade ingress-nginx controllers to the latest release containing the IngressNightmare fixes and restart/verify the controller deployment. Until patched, restrict RBAC permissions for creating or modifying Ingress resources (especially the auth-tls-match-cn annotation) to trusted administrators, avoid exposing controller pods directly to the internet, and review which Secrets the controller service account can read.