← Back to browse · API

CVE-2025-1974

Severity
CRITICAL
CVSS
9.8
EPSS
0.99517
Risk score
74.03
CISA KEV
No
PoC
No
Published
2025-03-24
Modified
2026-02-26
First seen
2026-08-07
Aliases
EUVD-2025-8035, GHSA-MGVX-RPFC-9MPV
Products
Kubernetes:ingress-nginx 0 ≤1.11.4, Kubernetes:ingress-nginx 1.12.0
Sources
euvd EUVD-2025-8035

Description

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

References