Ingress NGINX (<= 1.11.4, 1.12.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/ingress-nginx--1.11.4-1.12.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 16:51:40 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgIngress NGINX: Unauthenticated RCE via configuration injection (CVE-2025-1974)https://feed.craftedsignal.io/briefs/2026-10-ingress-nginx-rce/Fri, 30 Oct 2026 16:51:40 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-ingress-nginx-rce/A critical RCE vulnerability in the Ingress NGINX admission webhook allows unauthenticated attackers to inject malicious configuration snippets and execute arbitrary code or load malicious libraries.CVE-2025-1974 is an unauthenticated Remote Code Execution (RCE) vulnerability in the Ingress NGINX admission webhook (typically listening on port 8443). The issue exists because the webhook processes Ingress objects without authentication, allowing attackers to leverage the nginx.ingress.kubernetes.io/configuration-snippet annotation to inject configuration directives. This enables execution of arbitrary Lua code or the loading of malicious shared libraries via ssl_engine or load_module.

Impact

Successful exploitation grants RCE within the ingress controller pod. Because the admission controller service account typically possesses high-privileged permissions, attackers may be able to read all Kubernetes Secrets within the cluster.

Recommendation

  • Upgrade Ingress NGINX to version 1.11.5 or 1.12.1 or later immediately.
  • Implement network policies to restrict access to the admission webhook port (8443) to authorized traffic only.
  • Audit Kubernetes Secrets and RBAC permissions associated with the ingress-nginx service account.
]]>criticaladvisory