HighPublic exploitVulnerability

CVE-2025-24514

Configuration injection via auth-url annotation in ingress-nginx

Published Mar 24, 2025 · Updated 25 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVSS8.8High · v3.1

EPSS37.3%99th percentile

CISA KEVNoNot listed

In the wildNonePublic exploit, no exploitation reported

IdentifiersCVE-2025-24514CWE-94

CVE-2025-24514 is a configuration injection vulnerability in the Kubernetes ingress-nginx controller. Improper sanitization of the auth-url Ingress annotation allows an attacker to inject arbitrary nginx configuration through a crafted Ingress object. Exploitation can result in arbitrary code execution in the controller context and disclosure of Kubernetes Secrets accessible to its service account. Default installations grant the controller access to Secrets cluster-wide. This vulnerability is one of the issues collectively known as IngressNightmare.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can compromise the ingress-nginx controller through arbitrary code execution and expose Kubernetes Secrets within its access scope, which is cluster-wide by default. It can also compromise the integrity and availability of cluster ingress resources. Depending on the privileges and credentials exposed, Secret disclosure may enable broader compromise or complete Kubernetes cluster takeover.

Mitigation

If you can’t patch tonight, do this now.

Until upgrading, restrict permission to create or modify Ingress resources and vulnerable annotations, and reduce the controller's access to Secrets where feasible. These are operational risk-reduction measures rather than a complete fix. Disabling the Validating Admission Controller or restricting network access to its webhook mitigates the unauthenticated exploitation path involving CVE-2025-1974, but should not be treated as eliminating CVE-2025-24514's authenticated Ingress configuration injection path.

Remediation

Patch, then assume compromise.

Upgrade ingress-nginx to version 1.11.5 or later in the 1.11 release branch, or version 1.12.1 or later in the 1.12 release branch. Investigate suspected prior exploitation separately: upgrading does not remediate an existing compromise.

Public exploits

Exploits

2 exploits validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit; 1 not yet analyzed, such as Exploit-DB entries.

View more in app →

IngressNightmare-PoCThis repository provides a functional exploit for unauthenticated remote code execution (RCE) vulnerabilities in the Ingress NGINX Controller for Kubernetes (CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, CVE-2025-1974). The exploit consists of a Python script (exploit.py) that orchestrates the attack, a C template (lib_template.c) for generating a malicious shared object (evil_engine.so) containing a reverse shell payload, and a crafted AdmissionReview JSON (review.json) for the admission controller. The workflow involves compiling the shared object with attacker-supplied host and port, uploading it to the ingress pod via a manipulated HTTP POST request, and brute-forcing Linux file descriptors via the admission webhook to trigger the payload. The exploit targets Kubernetes clusters with vulnerable Ingress NGINX Controller versions and requires both the public ingress URL and the internal admission webhook URL. The payload, when loaded, provides a reverse shell to the attacker. The repository is well-structured, with clear separation of exploit logic, payload generation, and supporting files. No hardcoded IPs or domains are present; endpoints are supplied at runtime. The exploit is operational and demonstrates a practical attack chain for cluster compromise.hakaioffsec · Disclosed Mar 26, 2025 · python · c · networkOperational IngressNightmare-PoCThis repository contains two Python scripts, IngressNightmareV1.py and IngressNightmareV2.py, which are nearly identical in structure and function. Both scripts implement an exploit targeting Kubernetes environments, specifically leveraging exposed ingress endpoints and admission webhooks. The exploit works in two stages: first, it uploads a malicious ELF shared object (provided as a base64-encoded string in the script) to the ingress endpoint via a crafted HTTP POST request. Second, it attempts to brute-force file descriptors on the admission webhook endpoint by sending requests to /proc/{pid}/fd/{fd} paths, potentially exploiting a vulnerability that allows the attacker to keep the malicious file open and trigger its execution. The scripts use threading and concurrent requests to maximize the chance of success. The main capabilities are remote code execution or privilege escalation within a Kubernetes cluster. The scripts require the attacker to provide the ingress and admission webhook URLs as arguments. No hardcoded IPs or domains are present; all endpoints are user-supplied. The payload is a binary ELF shared object, indicating a high level of operational maturity.lufeirider · Disclosed Mar 30, 2025 · python · networkOperational

External references

References

MITRE CVEcve.org · CVE-2025-24514 NVDnvd.nist.gov/vuln/detail/CVE-2025-24514 MITRE CWE · CWE-94cwe.mitre.org github.comgithub.com/kubernetes/kubernetes/issues/131006 security.netapp.comsecurity.netapp.com/advisory/ntap-20250328-0008 exploit-db.comexploit-db.com/exploits/52475

Activity feed

Recent activity

16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

cloudatg insightsNews · Feb 13, 2026AI Development & Software Engineering | CloudATGOne of a set of critical Ingress NGINX Controller vulnerabilities that can lead to unauthenticated remote code execution in Kubernetes environments.Read more ↗coalitionincNews · Jan 1, 2026CVE-2025-1974 | Coalition Exploit Scoring SystemUnknownRead more ↗datadog security labsNews · Mar 25, 2025The 'IngressNightmare' vulnerabilities in the Kubernetes Ingress NGINX Controller: Overview, detection, and remediationA high-severity configuration injection vulnerability in ingress-nginx controller via unsanitized auth-url annotation, potentially allowing attackers to inject malicious NGINX configuration.Read more ↗kubernetes blogNews · Mar 24, 2025Ingress-nginx CVE-2025-1974: What You Need to Know | KubernetesOne of the ingress-nginx vulnerabilities patched in the March 2025 release; the article groups it among flaws involving nginx configuration handling that could contribute to Secret exposure and cluster takeover.Read more ↗

+2 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery report linking this CVE to a named adversary.

Associated malwareMalware families linked to this CVE, with evidence and IOCs.

Detection signatures1YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity8Community discussion across Reddit, Mastodon, and other social sources.