CVE-2025-1974

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. Note...

CVE-2025-24514 ingress-nginx controller - configuration injection via unsanitized auth-url annotation

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the auth-url Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets...

CVE-2025-1974

CVE-2025-1974 affects the Ingress-NGINX controller in Kubernetes, enabling unauthenticated code execution when a pod-network–reachable attacker can reach the admission/controller path. Public exploits exist (Ingress-NGINX Admission Controller RCE and related PoCs), with published exploit details ...

CVE-2025-1974 ingress-nginx admission controller RCE escalation

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. Note...

CVE-2025-1974 ingress-nginx admission controller RCE escalation

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. Note...

Critical Ingress NGINX Controller Vulnerability Allows RCE Without Authentication

A set of five critical security shortcomings have been disclosed in the Ingress NGINX Controller for Kubernetes that could result in unauthenticated remote code execution, putting over 6,500 clusters at immediate risk by exposing the component to the public internet. The vulnerabilities...

Kubernetes ingress-nginx 输入验证错误漏洞

Ingress NGINX Controller is an open source portal controller that uses NGINX as a reverse proxy and load balancer. Ingress NGINX Controller suffers from a remote code execution vulnerability that can be exploited by an attacker to gain access to sensitive data such as credentials and keys across...

GHSA-JFVP-7X6P-H2PV vulnerabilities

Vulnerabilities for packages: grafana-alloy, buildah, docker, syft, kubernetes, k8s-device-plugin, neuvector-scanner, runc, podman, ctop, k3s, opentelemetry-collector-contrib, cadvisor, grype...

CVE-2024-45310 vulnerabilities

Vulnerabilities for packages: cadvisor, cadvisor-fips, grafana-alloy, k3s, neuvector-fips, cluster-autoscaler, kubernetes-fips, neuvector-scanner, cluster-autoscaler-fips, eks-distro, ctop, k8s-device-plugin, eks-distro-fips, opentelemetry-collector-contrib, opentelemetry-collector-contrib-fips,...

CVE-2024-45310 vulnerabilities

Vulnerabilities for packages: grafana-alloy, buildah, docker, syft, kubernetes, k8s-device-plugin, neuvector-scanner, runc, podman, ctop, k3s, opentelemetry-collector-contrib, cadvisor, grype...

Ingress NGINX Controller 安全漏洞

Ingress NGINX Controller is a Kubernetes open source entry controller for Kubernetes. A security vulnerability exists in Ingress NGINX Controller versions prior to 1.11.2, which stems from a participant with permission to create Ingress objects can bypass annotation validation to inject arbitrary...

CVE-2024-34161 vulnerabilities

Vulnerabilities for packages: nginx-stable, nginx-mainline...

CVE-2024-35200 vulnerabilities

Vulnerabilities for packages: nginx-stable, nginx-mainline...

CVE-2024-31079 vulnerabilities

Vulnerabilities for packages: nginx-stable, nginx-mainline...

CVE-2024-3154 vulnerabilities

Vulnerabilities for packages: kubernetes, cadvisor, cadvisor-fips, opentelemetry-collector-contrib, ctop, wolfictl, opentelemetry-collector-contrib-fips, grype, neuvector-scanner, buildah...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: spicedb, flux-notification-controller, spire-server, minio, prometheus-operator-fips, cri-tools, caddy, fulcio-fips, nuclei, k8sgpt, prometheus-postgres-exporter-fips, crossplane-provider-azure-storage, dynamic-localpv-provisioner-fips,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: spicedb, flux-notification-controller, spire-server, minio, prometheus-operator-fips, cri-tools, caddy, fulcio-fips, nuclei, k8sgpt, prometheus-postgres-exporter-fips, crossplane-provider-azure-storage, dynamic-localpv-provisioner-fips,...

CVE-2024-21626 vulnerabilities

Vulnerabilities for packages: cadvisor, k3s, wolfictl, buildkitd, trivy, skaffold, ctop, zarf, kaniko, k9s, k3d, skopeo, grype, runc, syft, zot, kots, kubernetes, podman, docker, kubescape, newrelic-infrastructure-agent, nerdctl...

CVE-2024-21626 vulnerabilities

Vulnerabilities for packages: k9s, kots, docker, skopeo, k3d, podman, trivy, syft, wolfictl, kaniko, nerdctl, k3s, newrelic-infrastructure-agent, buildkitd, kubescape, runc, ctop, cadvisor, grype, zarf, skaffold, zot, kubernetes...

The vulnerability of the _nginxCmd() function of the Nginx web server control software, specifically the strong-nginx-controller, allows attackers to execute arbitrary commands.

The vulnerability of the nginxCmd function of the Nginx web server control software exists because measures to neutralize specific elements have not been taken. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...