Loading vulnerability…
Path traversal in ingress-nginx Admission Controller
CVE-2025-24513 is a path traversal vulnerability in the Kubernetes ingress-nginx Admission Controller. Attacker-controlled data incorporated into an authentication-secret filename can cause directory traversal within the controller container. Exploitation can cause denial of service and, when combined with other vulnerabilities, limited disclosure of Kubernetes Secret objects.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disrupt ingress-nginx availability. When chained with other vulnerabilities, it can also disclose a limited amount of Kubernetes Secret data from the cluster. Arbitrary code execution and full cluster compromise are not established as standalone impacts of this vulnerability.
If you can’t patch tonight, do this now.
If immediate patching is not possible, temporarily disable the ingress-nginx Validating Admission Controller. For Helm installations, set controller.admissionWebhooks.enabled=false. For manual installations, remove the admission ValidatingWebhookConfiguration and the validating-webhook argument from the controller Deployment or DaemonSet. Re-enable admission validation after upgrading. Restricting network access to the admission webhook provides an additional exposure-reduction measure.
Patch, then assume compromise.
Upgrade ingress-nginx to version 1.11.5 or later in the 1.11.x release line, or version 1.12.1 or later in the 1.12.x release line.
No public exploits tracked yet. Mallory keeps watching.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.