Skip to content

IngressNightmare Advisory Briefing (CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, CVE-2025-1974)

IngressNightmare refers to a set of critical ingress-nginx vulnerabilities disclosed in March 2025 with potential cluster-wide secret exposure risk.

At a Glance

Item Detail
Briefing type Security briefing
Primary audience Platform security and SRE
Action urgency Triage immediately

Advisory Summary

These vulnerabilities affect ingress-nginx controller deployments and can enable severe privilege abuse depending on exposure and controller permissions. In high-risk setups, attackers can pivot from ingress controller compromise to broader cluster credential access.

Affected Components and Versions

  • Component: ingress-nginx controller
  • Advisory date: March 2025
  • CVEs: CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, CVE-2025-1974
  • Scope: environments running vulnerable controller releases

Confirm exact affected and patched versions from upstream security advisory notes before rollout.

Why It Matters

Ingress controllers sit on a high-value trust boundary: they terminate external traffic and often have elevated permissions. A controller exploit is rarely isolated. It can expose service account tokens, TLS material, and other cluster secrets that increase blast radius quickly.

What to Do

  1. Inventory ingress-nginx versions in all clusters and identify vulnerable deployments.
  2. Patch to fixed versions immediately in internet-facing clusters.
  3. Rotate high-value credentials and service account tokens after patching.
  4. Review RBAC scope for ingress controllers and reduce unnecessary permissions.
  5. Add post-remediation monitoring for abnormal secret access and controller behavior.