IngressNightmare refers to a group of critical vulnerabilities discovered in the Ingress NGINX Controller, a widely used tool for managing HTTP/HTTPS traffic in Kubernetes clusters. Kubernetes, as an orchestration platform for containerized applications, relies on the Ingress NGINX Controller to efficiently route external requests to internal services. These vulnerabilities, uncovered by cybersecurity researchers, pose significant risks as they enable remote code execution (RCE) and potentially allow attackers to compromise entire Kubernetes clusters.
Understanding IngressNightmare: The Set of Vulnerabilities
The vulnerabilities collectively stem from improper validation within the admission controller component of the Ingress NGINX Controller. This admission controller processes ingress objects, which define how external traffic interacts with Kubernetes services. Unfortunately, the flawed validation mechanisms allow malicious ingress objects to bypass security protocols and inject arbitrary configurations into the system. These injected configurations can lead to unauthorized actions, including remote code execution, directory traversal, and cluster takeover.
Core Vulnerabilities
CVE-2025-1097:
- Exploitation involves unsanitized
auth-tls-match-cnannotations, enabling malicious configuration injection. - Severity: High (CVSS Score: 8.8).
- Impact: Attackers can inject configurations that allow unintended access control bypass.
CVE-2025-1098:
- Leverages unvalidated mirror annotations for injecting arbitrary NGINX directives.
- Severity: High (CVSS Score: 8.8).
- Impact: Injected directives can manipulate NGINX behavior to enable unauthorized actions.
CVE-2025-24514:
- Utilizes unsanitized
auth-urlannotations to execute malicious configurations. - Severity: High (CVSS Score: 8.8).
- Impact: Attackers may redirect traffic or compromise sensitive service endpoints.
CVE-2025-1974:
- Chains with other vulnerabilities to enable remote code execution.
- Severity: Critical (CVSS Score: 9.8).
- Impact: Arbitrary code execution can give attackers complete control over the affected pod.
CVE-2025-24513:
- Exploits improper input validation, resulting in directory traversal attacks.
- Severity: Medium (CVSS Score: 4.8).
- Impact: Attackers may gain unauthorized access to restricted files.
Technical Exploitation of IngressNightmare
How the Exploit Works
Attackers craft malicious ingress objects that take advantage of the flawed input validation logic in the admission controller. These ingress objects exploit specific annotations, allowing attackers to bypass established security protocols. Once the annotations are processed:
Configuration Injection:
- The malicious ingress object inserts arbitrary NGINX configurations into the controller.
Execution of Malicious Configurations:
- These configurations may include directives to bypass authentication, redirect traffic, or execute unauthorized commands.
Privilege Escalation:
- Attackers leverage this access to escalate privileges and gain control over the Kubernetes cluster.
Cluster Takeover:
- Once in control, attackers can manipulate secrets, access namespaces, deploy malware, or disrupt operations across the cluster.
Why It’s Particularly Dangerous
- Elevated Privileges: The admission controller operates with elevated permissions, enabling attackers to interact with the Kubernetes API and other critical components.
- Wide Exposure: Approximately 43% of cloud environments globally, representing 6,500 Kubernetes clusters, are vulnerable. Many Fortune 500 companies use the Ingress NGINX Controller, exacerbating the risk.
- Remote Exploitation: The vulnerabilities can be exploited remotely, without requiring physical access or credentials.
Implications of the Vulnerabilities
1. Remote Code Execution (RCE)
The most severe consequence is the ability for attackers to execute arbitrary code within the Ingress NGINX Controller’s pod. This can lead to:
- Deployment of malware within the cluster.
- Unauthorized access to sensitive resources and data.
2. Cluster Compromise
Exploiting these vulnerabilities allows attackers to:
- Access all secrets stored within the cluster namespaces.
- Manipulate workloads, crash critical services, or steal sensitive information.
3. Supply Chain Attacks
If compromised clusters interact with external services or upstream providers, attackers can infiltrate the supply chain, impacting a wider range of interconnected systems.
4. Business and Operational Risks
Organizations using vulnerable clusters may experience:
- Service outages and downtime.
- Damage to reputation due to data breaches.
- Financial losses from disrupted operations and response efforts.
Mitigation Strategies
To address these vulnerabilities, organizations need to adopt a multi-faceted approach that combines immediate patching, enhanced security practices, and proactive monitoring.
1. Apply Security Patches
The Kubernetes team has released patched versions of the Ingress NGINX Controller to mitigate the vulnerabilities. Update to:
- 1.12.1
- 1.11.5
- 1.10.7
2. Restrict Admission Controller Access
Limit access to the admission controller, ensuring that only the Kubernetes API server can interact with it. This reduces exposure to external threats.
3. Disable Admission Controller Temporarily
If patching is not immediately feasible and the admission controller is not essential for operations, disable it to eliminate the attack vector.
4. Implement Network Policies
Use Kubernetes network policies to control traffic flow and block unauthorized external requests targeting the admission controller.
5. Monitor Traffic and Logs
- Use firewalls, intrusion detection systems, and application logs to identify and block suspicious activities.
- Specifically monitor requests containing malicious annotations like
auth-tls-match-cn,mirror, andauth-url.
6. Audit Ingress Objects
Regularly review and validate ingress objects for any suspicious or misconfigured annotations.
7. Isolate Critical Workloads
Segment workloads within the Kubernetes cluster to minimize the impact of a breach and prevent lateral movement.
Final Thoughts
The discovery of IngressNightmare serves as a stark reminder of the growing threats to cloud-native applications and container orchestration platforms like Kubernetes. Organizations that rely on Kubernetes must prioritize security by adopting patching practices, refining network controls, and continuously monitoring their environments.
These vulnerabilities highlight the importance of proactive security in safeguarding cloud infrastructure from increasingly sophisticated attacks.
