CVE-2025-1974: ingress-nginx admission controller unauthenticated RCE (IngressNightmare)

Critical 9.8 EPSS 99.4% Kubernetes

The Validating Admission Controller of the Kubernetes ingress-nginx controller lets anything that can reach the pod network feed it crafted Ingress objects and run arbitrary code inside the controller, with no credentials. Because the controller can by default read all Secrets cluster-wide, this can lead to full cluster takeover. It was fixed together with four related configuration-injection bugs (CVE-2025-24513, CVE-2025-24514, CVE-2025-1097, CVE-2025-1098) and is rated CVSS 9.8 by the Kubernetes project.

Also known as “IngressNightmare”.

CVE-2025-1974CVE identifier
9.8CVSS 3.1 base score (critical)
99.4%EPSS: chance of exploitation in the next 30 days (higher than 100% of CVEs)
2025-03-24published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

What to do now

Check whether you run Kubernetes and which version (commands below).
Install the fixed version for your system: see “Patch it” below.
The controller pods are replaced by the Deployment/DaemonSet rollout; no node reboot is needed.
If you cannot patch today, apply the temporary mitigation below and patch as soon as possible.

Affected and fixed versions

Affected:

ingress-nginx controller before v1.11.0
ingress-nginx controller v1.11.0 through v1.11.4
ingress-nginx controller v1.12.0

Fixed in:

ingress-nginx controller v1.11.5 (Helm chart 4.11.5)
ingress-nginx controller v1.12.1 (Helm chart 4.12.1)

Am I affected?

kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginx
kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginx -o jsonpath='{range .items[*]}{.spec.containers[*].image}{"\n"}{end}'
helm list --all-namespaces | grep ingress-nginx

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

Debian

sudo apt update
sudo apt install --only-upgrade kubernetes-client (kubectl only; cluster: pkgs.k8s.io kubelet kubeadm)

Ubuntu

not in distro repos: pkgs.k8s.io kubelet kubeadm kubectl, or snap

RHEL, AlmaLinux, Rocky, Oracle

not in distro repos: pkgs.k8s.io kubelet kubeadm kubectl

Fedora

sudo dnf upgrade --refresh kubernetes1.36 kubernetes1.36-kubeadm kubernetes1.36-client (kubernetes1.NN)

SUSE / openSUSE

not in Leap 16: pkgs.k8s.io

Amazon Linux

not in distro repos: pkgs.k8s.io; EKS AMIs

Arch Linux

sudo pacman -Syu

Alpine

apk update && apk upgrade kubelet kubeadm kubectl

FreeBSD

pkg update && pkg upgrade kubectl (client only)

Docker images

# Helm installs (release named ingress-nginx):
helm repo update
helm upgrade --reuse-values ingress-nginx ingress-nginx/ingress-nginx -n ingress-nginx --version 4.12.1
# Manifest installs: set a fixed image on the controller Deployment
kubectl set image deployment/ingress-nginx-controller -n ingress-nginx \
  controller=registry.k8s.io/ingress-nginx/controller:v1.12.1@sha256:d2fbc4ec70d8aa2050dd91a91506e998765e86c96f32cffb56c503c9c34eed5b
# (v1.11 line: registry.k8s.io/ingress-nginx/controller:v1.11.5@sha256:a1cbad75b0a7098bf9325132794dddf9eef917e8a7fe246749a4cea7ff6f01eb)

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

If you cannot patch yet

If you cannot upgrade at once, turn off the Validating Admission Controller: for Helm installs, reinstall with the value controller.admissionWebhooks.enabled=false.
For manual installs, delete the ValidatingWebhookConfiguration named ingress-nginx-admission and remove --validating-webhook from the controller container's arguments in the ingress-nginx-controller Deployment or DaemonSet.
Turn the admission controller back on after upgrading.
The Kubernetes project retired ingress-nginx in March 2026: after that there are no further releases or security fixes, so plan a move to another ingress controller or Gateway API implementation.

Look for signs of exploitation

The Kubernetes project reported no known indicators of compromise; report suspected exploitation to security@kubernetes.io.

Related vulnerabilities

Sources

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.