Description
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| kubernetes | ingress-nginx | ≤ 1.11.4, 1.12.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250327T184518-1.1 | openSUSE-SU-2025:14937-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | ingress-nginx-controller-1.12 | 1.12.1-r14 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | k8s.io/ingress-nginx | < 1.11.5 | 1.11.5 | GHSA-242m-6h72-7hgp |
| Go | k8s.io/ingress-nginx | >= 1.12.0-beta.0, < 1.12.1 | 1.12.1 | GHSA-242m-6h72-7hgp |
| Go | k8s.io/ingress-nginx | all versions | — | GO-2025-3564 |
Advisories 6
- openSUSE-SU-2025:14937-1 govulncheck-vulndb-0.0.20250327T184518-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-0629 Ingress NGINX Controller für Kubernetes: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 15, 2026
- NCSC-2025-0106 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Apr 8, 2025
- ICSA-25-100-05 Siemens Insights Hub Private Cloud CISA ICS & IT advisories · Apr 8, 2025
- SSA-817234 SSA-817234: Multiple Kubernetes Ingress NGINX Controller Vulnerabilities in Insights Hub Private Cloud Siemens ProductCERT · Apr 8, 2025
- NCSC-2025-0095 Kwetsbaarheden verholpen in Kubernetes Ingress NGINX Controller NCSC-NL (Netherlands) · Mar 27, 2025