Arbitrary Code Execution Vulnerability in Ingress-Nginx by Kubernetes
CVE-2025-1098

8.8HIGH

Key Information:

Vendor

Kubernetes
Status
Ingress-nginx
Vendor
CVE Published:
25 March 2025

What is CVE-2025-1098?

A security issue was identified in ingress-nginx affecting Kubernetes deployments, where the mirror-target and mirror-host annotations could be exploited to inject malicious configuration into the Nginx controller. This could result in arbitrary code execution under the privileges of the ingress-nginx controller, enabling the potential disclosure of Secrets accessible to it. Given that the default configuration allows the controller to retrieve all Secrets across the cluster, this vulnerability poses a significant risk to the integrity and confidentiality of sensitive data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

ingress-nginx 0 <= 1.11.4

ingress-nginx 1.12.0

References

https://github.com/kubernetes/kubernetes/issues/131008

EPSS Score

53% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

JSON
.