InfoSecBulletin Cybersecurity for mankind
Kubernetes users of the Ingress NGINX Controller are advised to fix four newly found remote code execution ( RCE) vulnerabilities, which have a CVSS score of 9.8.
Wiz Security named four vulnerabilities “IngressNightmare” that affect the admission controller of the popular open-source software used for directing external traffic to Kubernetes services and pods.
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Wiz Research claimed the flaws impact 43% of all cloud environments, including many Fortune 500 companies. Because the software’s admission controllers are typically exposed to the public internet, they are at “critical risk” of attack, it warned.
The vulnerabilities are CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, and CVE-2025-1974. The first three allow an attacker to inject arbitrary NGINX configuration directives, potentially leading to remote code execution when combined with the fourth vulnerability.
“When the Ingress-NGINX admission controller processes an incoming ingress object, it constructs an NGINX configuration from it and then validates it using the NGINX binary. Our team found a vulnerability in this phase that allows injecting an arbitrary NGINX configuration remotely, by sending a malicious ingress object directly to the admission controller through the network,” Wiz Security explained.
“During the configuration validation phase, the injected NGINX configuration causes the NGINX validator to execute code, allowing remote code execution (RCE) on the Ingress NGINX Controller’s pod.”
The admission controller has high-level permissions and full network access, so exploiting these vulnerabilities could let an attacker run any code, access all cluster secrets, and fully control a targeted cluster, it added.
Kubernetes admins should upgrade to Ingress NGINX Controller versions 1.12.1 and 1.11.5, and make sure the admission webhook endpoint is not publicly accessible.
The security vendor has provided mitigations for those unable to upgrade to patched versions right away.
