Ingress NGINX: Unauthenticated RCE via configuration injection (CVE-2025-1974)
A critical RCE vulnerability in the Ingress NGINX admission webhook allows unauthenticated attackers to inject malicious configuration snippets and execute arbitrary code or load malicious libraries.
CVE search metadata
CVE search record: CVE-2025-1974. Severity: critical. CVSS: 9.8. EPSS: 99.40%. KEV: no. Product: Ingress NGINX (<= 1.11.4, 1.12.0). Brief: Ingress NGINX: Unauthenticated RCE via configuration injection (CVE-2025-1974). Brief link: https://feed.craftedsignal.io/briefs/2026-10-ingress-nginx-rce/
Triage facts
Revision 1- Applicability
- Ingress NGINX (<= 1.11.4, 1.12.0)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 30, 16:51 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- B2Very likely
CVE-2025-1974 is an unauthenticated Remote Code Execution (RCE) vulnerability in the Ingress NGINX admission webhook (typically listening on port 8443). The issue exists because the webhook processes Ingress objects without authentication, allowing attackers to leverage the nginx.ingress.kubernetes.io/configuration-snippet annotation to inject configuration directives. This enables execution of arbitrary Lua code or the loading of malicious shared libraries via ssl_engine or load_module.
Impact
Successful exploitation grants RCE within the ingress controller pod. Because the admission controller service account typically possesses high-privileged permissions, attackers may be able to read all Kubernetes Secrets within the cluster.
Recommendation
- Upgrade Ingress NGINX to version 1.11.5 or 1.12.1 or later immediately.
- Implement network policies to restrict access to the admission webhook port (8443) to authorized traffic only.
- Audit Kubernetes Secrets and RBAC permissions associated with the
ingress-nginxservice account.
Immediate actions
Patch Ingress NGINX to 1.11.5+ or 1.12.1+ across all clusters
Threat Hunt
Monitor for suspicious Ingress object annotations containing configuration snippets
Data: Kubernetes Audit Logs (Ingress object create/update events)
Mitigations
Apply NetworkPolicy to restrict ingress-nginx admission webhook traffic
CVE-2025-1974