Vulnerabilitycritical

Critical Ingress NGINX Controller Vulnerability Allows RCE Without Authentication

The Hacker Newsby @TheHackersNewsApr 10, 2025 · 06:49 UTC (Apr 10, 2025)4 min read1 · 1 read

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2025-24513 CVE-2025-24514 CVE-2025-1097 CVE-2025-1098 CVE-2025-1974

Tags: cve-2025-24513 cve-2025-24514 cve-2025-1097 cve-2025-1098 cve-2025-1974 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2025-1098 +3 related CVEs CVE-2025-1097 CVE-2025-24514 CVE-2025-24513	Config Injection via Ingress Annotations Enables RCE in ingress-nginx	8.8 group max	83%		Mar 25, 2025
CVE-2025-1974	Unauthenticated RCE in Kubernetes ingress-nginx controller (IngressNightmare)	9.8	100%		Mar 25, 2025

From the original article

4 min read at thehackernews.com

 Ravie Lakshmanan  Mar 24, 2025 Vulnerability / Cloud Security A set of five critical security shortcomings have been disclosed in the Ingress NGINX Controller for Kubernetes that could result in unauthenticated remote code execution, putting over 6,500 clusters at immediate risk by exposing the component to the public internet.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.