ingress-nginx controller - configuration injection via unsanitized mirror annotations

🗓️ 25 Mar 2025 00:30:26Reported by GitHub Advisory DatabaseType

Security issue in ingress-nginx allows configuration injection leading to code execution risks.

Reporter	Title	Published	Views	Family All 71
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in ingress-nginx	14 Apr 202515:17	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	29 Apr 202502:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Kubernetes Service is affected by Kubernetes Ingress Controller security vulnerabilities (CVE-2025-24514, CVE-2025-1097, CVE-2025-1098)	3 Apr 202516:57	–	ibm
GithubExploit	Exploit for CVE-2025-1974	27 Apr 202505:07	–	githubexploit
GithubExploit	Exploit for CVE-2025-1974	26 Mar 202506:43	–	githubexploit
GithubExploit	Exploit for CVE-2025-1974	26 Apr 202502:30	–	githubexploit
GithubExploit	Exploit for CVE-2025-1097	26 Mar 202518:52	–	githubexploit
GithubExploit	Exploit for CVE-2025-1974	26 Jun 202509:24	–	githubexploit
Information Security Automation	About Remote Code Execution – Kubernetes (CVE-2025-1974) vulnerability	27 Mar 202518:51	–	avleonov
Information Security Automation	April Microsoft Patch Tuesday	10 Apr 202522:59	–	avleonov

Vulners

Node

k8s.io ingress-nginxRange1.12.0-beta.0–1.12.1go

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-1098
github	www.github.com/kubernetes/kubernetes/issues/131008
github	www.github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.11.5
github	www.github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.12.1
groups	www.groups.google.com/g/kubernetes-security-announce/c/2qa9DFtN0cQ
security	www.security.netapp.com/advisory/ntap-20250328-0008
github	www.github.com/advisories/GHSA-vg63-w3p9-jc9m

03 Nov 2025 21:33Current

7.9High risk

Vulners AI Score7.9

CVSS 3.18.8

EPSS0.34184

SSVC