CVE-2025-1098

🗓️ 24 Mar 2025 23:29:15Reported by kubernetesType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 501 Views🌐 WEB

Security issue in ingress-nginx allows configuration injection, leading to code execution and Secrets disclosure.

Reporter	Title	Published	Views	Family All 126
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in ingress-nginx	14 Apr 202515:17	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	29 Apr 202502:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Kubernetes Service is affected by Kubernetes Ingress Controller security vulnerabilities (CVE-2025-24514, CVE-2025-1097, CVE-2025-1098)	3 Apr 202516:57	–	ibm
GithubExploit	Exploit for CVE-2025-1974	27 Apr 202505:07	–	githubexploit
GithubExploit	Exploit for CVE-2025-1974	26 Mar 202506:43	–	githubexploit
GithubExploit	Exploit for CVE-2025-1974	26 Apr 202502:30	–	githubexploit
GithubExploit	Exploit for CVE-2025-1097	26 Mar 202518:52	–	githubexploit
GithubExploit	Exploit for CVE-2025-1974	26 Jun 202509:24	–	githubexploit
Information Security Automation	About Remote Code Execution – Kubernetes (CVE-2025-1974) vulnerability	27 Mar 202518:51	–	avleonov
Information Security Automation	April Microsoft Patch Tuesday	10 Apr 202522:59	–	avleonov

[
  {
    "defaultStatus": "unaffected",
    "product": "ingress-nginx",
    "repo": "https://github.com/kubernetes/ingress-nginx",
    "vendor": "kubernetes",
    "versions": [
      {
        "lessThanOrEqual": "1.11.4",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "1.12.0"
      }
    ]
  }
]

Source	Link
github	www.github.com/kubernetes/kubernetes/issues/131008
exploit-db	www.exploit-db.com/exploits/52475
security	www.security.netapp.com/advisory/ntap-20250328-0008/

Parameter	Position	Path	Description	CWE
json_data	request body	/admission	Unauthenticated Admission Controller endpoint where an attacker can inject arbitrary configuration (e.g., ssl_engine) into the NGINX configuration, leading to RCE when the controller runs 'nginx -t'.	CWE-20
auth-url	query param	/networking/v1/ingresses	Kubernetes API endpoint for Ingress resources. Vulnerable annotations (auth-url, auth-tls-match-cn, mirror-target, mirror-host) can be used to inject arbitrary configuration into the ingress-nginx controller.	CWE-20
auth-tls-match-cn	query param	/networking/v1/ingresses	Kubernetes API endpoint for Ingress resources. Vulnerable annotations (auth-url, auth-tls-match-cn, mirror-target, mirror-host) can be used to inject arbitrary configuration into the ingress-nginx controller.	CWE-20
mirror-target	query param	/networking/v1/ingresses	Kubernetes API endpoint for Ingress resources. Vulnerable annotations (auth-url, auth-tls-match-cn, mirror-target, mirror-host) can be used to inject arbitrary configuration into the ingress-nginx controller.	CWE-20
mirror-host	query param	/networking/v1/ingresses	Kubernetes API endpoint for Ingress resources. Vulnerable annotations (auth-url, auth-tls-match-cn, mirror-target, mirror-host) can be used to inject arbitrary configuration into the ingress-nginx controller.	CWE-20

17 Jun 2026 08:38Current

7.2High risk

Vulners AI Score7.2

CVSS 3.18.8

EPSS0.86146

SSVC

CWE-20

cve-2025-1098 ingress-nginx configuration injection code execution secrets disclosure