CVE-2025-1974
A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 99.52%
- CWE
- CWE-653
- Published
- 2025-03-24
- Last modified
- 2026-03-13
Affected products
- kubernetes ingress-nginx
- kubernetes ingress-nginx
Weakness type
Related vulnerabilities
- CVE-2026-15366 — A control logic defect in a specific built-in webpage of Kids Mode allows users to view local...
- CVE-2026-71325 — Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef
- CVE-2026-62246 — Kamaji: TenantControlPlane namespace/name collision binds two tenants to the same SQL datastore schema + DB user, breaking per-tenant isolation
- CVE-2026-65635 — Boruta dynamic client registration allows creation of over-privileged OAuth clients
- CVE-2026-53421 — Apache Syncope: Remote Code Execution via Scripted Connector
- CVE-2026-53405 — Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask
- CVE-2026-63071 — Apache Syncope: RCE via Groovy Sandbox bypass
- CVE-2026-15738 — Cross-namespace traffic interception via incorrect route precedence ordering in AWS Load Balancer Controller