What Happened

Wiz Research disclosed five vulnerabilities in the ingress-nginx controller for Kubernetes, collectively named IngressNightmare. The critical flaw, CVE-2025-1974 (CVSS 9.8), allows unauthenticated remote code execution via the admission webhook endpoint.

How It Works

Ingress-nginx runs a validating admission webhook to validate ingress objects before they're applied. This webhook:

  1. Runs with access to the service account token
  2. Has permissions to read all cluster secrets (required for TLS termination)
  3. Is reachable from any pod in the cluster (not just the API server)

An attacker who compromises any pod in the cluster can send crafted annotation payloads to the webhook, triggering nginx config injection, and ultimately executing arbitrary commands in the ingress-nginx pod — then accessing all cluster secrets.

Impact Scope

Wiz estimates approximately 43% of cloud environments run ingress-nginx. This includes most managed Kubernetes deployments on GKE, EKS, and AKS that use the standard ingress controller.

Recommended Actions

  1. Upgrade immediately to ingress-nginx >= 1.11.5 or >= 1.12.1
  2. If unable to upgrade, add --disable-full-test flag and restrict admission webhook via network policy:
   # Only allow API server to reach webhook

   podSelector:


     matchLabels:


       app.kubernetes.io/name: ingress-nginx


   ingress:


  • from:
  • ipBlock:
         cidr: <api-server-cidr>
  1. Audit ServiceAccount permissions for ingress-nginx
  2. Review cluster events for unusual secret access patterns