CVE-2025-1098

CVE-2025-1098 is an input-validation flaw (CWE-20) in the Kubernetes ingress-nginx controller: the `mirror-target` and `mirror-host` Ingress annotations are not properly sanitized, allowing arbitrary NGINX configuration directives to be injected into the controller's generated configuration. An attacker who can create or modify Ingress resources in the cluster (low privileges, no user interaction required) crafts these annotation values, and the injected configuration is consumed by the controller's NGINX instance to execute arbitrary code in the context of the ingress-nginx controller. Successful exploitation also leads to disclosure of Secrets accessible to the controller; in a default installation the controller can read every Secret cluster-wide, enabling credential theft and potentially full cluster takeover. Any Kubernetes cluster running a vulnerable ingress-nginx controller is affected, and public research tied to the related 'IngressNightmare' disclosures found the component in roughly 40% of cloud environments. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but EPSS assigns this CVE an 83.5% probability of exploitation within 30 days (100th percentile), so rapid patching is warranted.

What to do: Upgrade all ingress-nginx controllers to the patched releases (v1.12.1 or v1.11.5 per the vendor advisory) and restart controller pods. As interim mitigations, restrict RBAC so only trusted principals can create or update Ingress objects or set the mirror-target/mirror-host annotations (e.g., via a ValidatingAdmissionPolicy), and limit the controller's Secret access below cluster-wide where possible. Also patch the related IngressNightmare CVEs disclosed alongside this one and review clusters for exposed admission webhooks.