CVE-2025-24514

CVE-2025-24514 is an input validation flaw (CWE-20) in the Kubernetes ingress-nginx controller in which the auth-url Ingress annotation is inserted into the nginx configuration without sufficient sanitization. An attacker who can create or modify Ingress resources (the low-privilege requirement in the CVSS vector) can supply a crafted auth-url value that injects arbitrary nginx configuration directives into the controller. Successful exploitation yields arbitrary code execution in the context of the ingress-nginx controller and disclosure of Secrets the controller can access — which, in a default installation, means all Secrets cluster-wide, potentially enabling broader cluster compromise. Any environment running affected versions of the ingress-nginx controller is exposed; related reporting on the 'IngressNightmare' bug set says the component runs in roughly 40% of cloud environments. No public proof-of-concept or confirmed in-the-wild exploitation is known for this flaw, but its EPSS of 32.6% (98th percentile) indicates a substantial probability of exploitation within 30 days.

What to do: Upgrade the ingress-nginx controller to the latest patched release published by the project and confirm running controller pods use the fixed image. Restrict RBAC permissions to create or modify Ingress resources to trusted principals and audit existing Ingress objects for auth-url annotations. Because a default installation lets the controller read all Secrets cluster-wide, consider narrowing its Secret access as defense-in-depth.