{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3akubernetesingress-nginx/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:kubernetes:ingress-nginx:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2025-1974"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Ingress NGINX (\u003c= 1.11.4, 1.12.0)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Kubernetes"],"content_html":"\u003cp\u003eCVE-2025-1974 is an unauthenticated Remote Code Execution (RCE) vulnerability in the Ingress NGINX admission webhook (typically listening on port 8443). The issue exists because the webhook processes Ingress objects without authentication, allowing attackers to leverage the \u003ccode\u003enginx.ingress.kubernetes.io/configuration-snippet\u003c/code\u003e annotation to inject configuration directives. This enables execution of arbitrary Lua code or the loading of malicious shared libraries via \u003ccode\u003essl_engine\u003c/code\u003e or \u003ccode\u003eload_module\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation grants RCE within the ingress controller pod. Because the admission controller service account typically possesses high-privileged permissions, attackers may be able to read all Kubernetes Secrets within the cluster.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Ingress NGINX to version 1.11.5 or 1.12.1 or later immediately.\u003c/li\u003e\n\u003cli\u003eImplement network policies to restrict access to the admission webhook port (8443) to authorized traffic only.\u003c/li\u003e\n\u003cli\u003eAudit Kubernetes Secrets and RBAC permissions associated with the \u003ccode\u003eingress-nginx\u003c/code\u003e service account.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T16:51:40Z","date_published":"2026-10-30T16:51:40Z","id":"https://feed.craftedsignal.io/briefs/2026-10-ingress-nginx-rce/","summary":"A critical RCE vulnerability in the Ingress NGINX admission webhook allows unauthenticated attackers to inject malicious configuration snippets and execute arbitrary code or load malicious libraries.","title":"Ingress NGINX: Unauthenticated RCE via configuration injection (CVE-2025-1974)","url":"https://feed.craftedsignal.io/briefs/2026-10-ingress-nginx-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:kubernetes:ingress-Nginx:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}