CVE-2025-1974

CVE-2025-1974 is a critical (CVSS 9.8) unauthenticated remote code execution flaw in the Kubernetes ingress-nginx controller, identified as part of the IngressNightmare set of defects. An attacker who has any access to the pod network, with no credentials required, can trigger the flaw and execute arbitrary code in the context of the ingress-nginx controller process. From that position the attacker can disclose Secrets accessible to the controller, and in a default installation the controller can read all Secrets cluster-wide, which follow-on coverage notes can lead to Kubernetes cluster takeover. Any Kubernetes cluster running the ingress-nginx controller is affected; public research cited in the headlines estimates the component is present in roughly 40% of cloud environments. No public proof-of-concept or confirmed in-the-wild exploitation is known at this time, but EPSS assigns a 99.5% probability of exploitation within 30 days, making urgent patching prudent.

What to do: Upgrade the ingress-nginx controller to the patched release identified in the project's security advisory for CVE-2025-1974. Until patched, restrict pod-network access to the controller (including its admission webhook endpoint) so only the Kubernetes control plane can reach it, and consider narrowing the controller's RBAC so it cannot read all Secrets cluster-wide. Review audit logs for unexpected requests to the controller and inventory clusters for ingress-nginx deployments, especially internet-facing ones.