CVSS 9.8 ingress-nginx flaw lets unauthenticated attackers get RCE and steal cluster Secrets
evilsocket · x · 2026-11-02
A widely shared disclosure details CVE-2025-1974 (CVSS 9.8, Critical): an unauthenticated attacker who can reach a vulnerable ingress-nginx admission webhook (port 8443) can inject malicious NGINX config, achieve RCE, and potentially steal cluster-wide Kubernetes Secrets — no K8s credentials required.
Preconditions: a vulnerable ingress-nginx version plus network access to the webhook (e.g. a compromised pod or exposed endpoint). Affects versions up to 1.11.4 and 1.12.0 pre-releases; fixed in 1.11.5 and 1.12.1. Not yet in CISA KEV, but there are already 2 public exploits on Exploit-DB, 25 GitHub PoCs and a Nuclei template.
More from Infra
- BofA: B200 and H100 GPU rental prices hit new highs, up 47% and 31% YTD — TheZachMueller · 2026-11-02
- vikhyat predicts alternating compute oversupply and undersupply on the road to AGI — TheZachMueller · 2026-11-02
- PyTorch Mac downloads hit 3.29M in October, up 20.5% MoM — LysandreJik · 2026-11-02
- RAM prices tripled, so Tesla cut a third of memory from Optimus's brain — aakashgupta · 2026-11-02
- Liquid AI's 1.7B LFM3 becomes first local model to nail live fixtures lookup on a MacBook — NielsRogge · 2026-11-02
- To dethrone Postgres, new databases must prioritize ecosystem integrations from day one — mgill25 · 2026-11-02