Ingress NGINX Controller Vulnerability in Kubernetes

CVE-2025-15566

What is CVE-2025-15566?

A vulnerability has been identified in ingress-nginx that exploits the nginx.ingress.kubernetes.io/auth-proxy-set-headers annotation, which can inject unauthorized configuration into the NGINX controller. This weakness allows attackers to execute arbitrary code within the controller's context and potentially expose sensitive secrets that are accessible across the entire Kubernetes cluster. With default settings, the ingress-nginx controller has unrestricted access to all secrets, making this vulnerability particularly severe.

References