Ingress NGINX Controller pod is vulnerable to critical remote code execution vulnerability (IngressNightmare)

kubernetes

Set up the kubernetes integration.

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Description

This check assesses Kubernetes clusters for vulnerabilities associated with the Ingress NGINX Controller, collectively known as “IngressNightmare.” These critical vulnerabilities, including CVE-2025-1974, CVE-2025-24513, CVE-2025-24514, CVE-2025-1097, and CVE-2025-1098, can allow unauthenticated remote code execution (RCE) and unauthorized access to sensitive data within the cluster. Exploitation of these vulnerabilities could lead to a complete cluster takeover.

Remediation

To mitigate the risks associated with the IngressNightmare vulnerabilities:

  1. Update the Ingress NGINX Controller:
    Upgrade to the latest patched versions—1.12.1, 1.11.5, or 1.10.7—which address these vulnerabilities.

  2. Restrict Access to the Admission Controller:
    Ensure that the admission webhook endpoint is not exposed externally. Limit access to only the Kubernetes API server to prevent unauthorized ingress object submissions.

  3. Monitor and Detect Exploitation Attempts:
    Implement monitoring solutions to detect unusual activities, such as loading shared libraries from the /proc filesystem within the NGINX Ingress container, which may indicate exploitation attempts.

For detailed guidance on these vulnerabilities and their mitigation, refer to the Kubernetes Official Blog on CVE-2025-1974.