Description
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| kubernetes | ingress-nginx | ≤ 1.11.4, 1.12.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250327T184518-1.1 | openSUSE-SU-2025:14937-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | ingress-nginx-controller-1.12 | 1.12.1-r14 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Ingress-NGINX Admission Controller v1.11.1 - FD Injection to RCE EDB-52475 · remote · Feb 4, 2026
GitHub 2 repositories
-
hakaioffsec/IngressNightmare-PoC ★ 248 · Mar 26, 2025
This is a PoC code to exploit the IngressNightmare vulnerabilities (CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, and CVE-2025-1974).
-
lufeirider/IngressNightmare-PoC ★ 9 · Mar 30, 2025
IngressNightmare-PoC： (CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, CVE-2025-1974) PoC ，One-click script 。 一键脚本
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-tls-match-cn` Annotation http/cves/2025/CVE-2025-1097.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | k8s.io/ingress-nginx | < 1.11.5 | 1.11.5 | GHSA-823x-fv5p-h7hw |
| Go | k8s.io/ingress-nginx | >= 1.12.0-beta.0, < 1.12.1 | 1.12.1 | GHSA-823x-fv5p-h7hw |
| Go | k8s.io/ingress-nginx | all versions | — | GO-2025-3565 |
Advisories 6
- openSUSE-SU-2025:14937-1 govulncheck-vulndb-0.0.20250327T184518-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-0629 Ingress NGINX Controller für Kubernetes: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 15, 2026
- NCSC-2025-0106 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Apr 8, 2025
- ICSA-25-100-05 Siemens Insights Hub Private Cloud CISA ICS & IT advisories · Apr 8, 2025
- SSA-817234 SSA-817234: Multiple Kubernetes Ingress NGINX Controller Vulnerabilities in Insights Hub Private Cloud Siemens ProductCERT · Apr 8, 2025
- NCSC-2025-0095 Kwetsbaarheden verholpen in Kubernetes Ingress NGINX Controller NCSC-NL (Netherlands) · Mar 27, 2025