14 matches found
CVE-2025-1974
Kubernetes Ingress-NGINX 인증되지 않은 원격 코드 실행CVE-2025-1974 Ingress-NGINX: NGINX를 역방향 프록시 및 로드 밸런서로 사용하는 Kubernetes 용 인그레스 컨트롤러 "IngressNightmare" 취약점CVE-2025-1974은 수신되는 Ingree 리소스의 유효성을 검사하는 쿠버네티스의 핵심 보안 메커니즘인 Ingress-NGINX Admission Controller 의 치명적인 결함에서 비롯된다. 이 컨트롤러는 인증 없이도 네트워크에 노출되어 공격자가 악성...
cve-2026-24514-Kubernetes-Dos
CVE-2026-24514 – ingress-nginx 検証用アドミッションWebhookにおける重大なメモリ枯渇 未認証/低権限のリモートサービス拒否（DoS）脆弱性。攻撃者が過大なAdmissionReviewリクエストを送信することで、ingress-nginxコントローラーのPodをクラッシュさせることが可能です。 概要とビジネスへの影響 ingress-nginx の検証用アドミッションWebhook（有効時）は、受信するAdmissionReviewオブジェクトのサイズに合理的な制限を課していません。...
CVE-2025-1974-PoC-exploit
CVE-2025-1974-PoC-exploit Kubernetes Ingress-nginx RCE（IngressNightmare） root@kitploit: ❯ python3 exploit.py http://localhost:8443 "id" ============================================================ CVE-2025-1974 - IngressNightmare Exploit ===========================================================...
CVE-2025-1974
CVE-2025-1974 ホワイトハットスクール3期 - 김소은 @salt318 https://github.com/salt318/vulhub 概要 Kubernetesの中核セキュリティメカニズムであるIngress-NGINX Admission Controllerの欠陥により発生 Ingress-NGINX Admission Controllerは認証なしでネットワークに露出している これにより、攻撃者は悪意のあるAdmissionReviewリクエストを操作して、Ingressリソースに不正な構成を挿入できる...
SUSE CVE-2026-26055
Yoke is a Helm-inspired infrastructure-as-code IaC package deployer. In 0.19.0 and earlier, a vulnerability exists in the Air Traffic Controller ATC component of Yoke. The ATC webhook endpoints lack proper authentication mechanisms, allowing any pod within the cluster network to directly send...
Exploit for CVE-2026-24514
!Authorhttps://img.shields.io/badge/Author-Mohammed%20Idrees%...
CVE-2026-26055
Yoke is a Helm-inspired infrastructure-as-code IaC package deployer. In 0.19.0 and earlier, a vulnerability exists in the Air Traffic Controller ATC component of Yoke. The ATC webhook endpoints lack proper authentication mechanisms, allowing any pod within the cluster network to directly send...
CVE-2026-26055 Unauthenticated Admission Webhook Endpoints in Yoke ATC
Yoke is a Helm-inspired infrastructure-as-code IaC package deployer. In 0.19.0 and earlier, a vulnerability exists in the Air Traffic Controller ATC component of Yoke. The ATC webhook endpoints lack proper authentication mechanisms, allowing any pod within the cluster network to directly send...
CVE-2026-26055
Yoke is a Helm-inspired infrastructure-as-code IaC package deployer. In 0.19.0 and earlier, a vulnerability exists in the Air Traffic Controller ATC component of Yoke. The ATC webhook endpoints lack proper authentication mechanisms, allowing any pod within the cluster network to directly send...
PT-2026-7905
Name of the Vulnerable Software and Affected Versions Yoke versions 0.18.x and earlier Description The Air Traffic Controller ATC component of Yoke lacks proper authentication mechanisms for its webhook endpoints. This allows any pod within the cluster network to send AdmissionReview requests...
CVE-2026-26055: Missing Authentication for Critical Function
Yoke is a Helm-inspired infrastructure-as-code IaC package deployer. In 0.19.0 and earlier, a vulnerability exists in the Air Traffic Controller ATC component of Yoke. The ATC webhook endpoints lack proper authentication mechanisms, allowing any pod within the cluster network to directly send...
Exploit for CVE-2025-1974
Kubernetes Ingress-NGINX 인증되지 않은 원격 코드 실행CVE-2025-1974 Ingr...