Full Report
Frequently asked questions about five vulnerabilities in the Ingress NGINX Controller for Kubernetes, collectively known as IngressNightmare.BackgroundThe Tenable Security Response Team (SRT) has compiled this blog to answer Frequently Asked Questions (FAQ) regarding IngressNightmare.FAQWhat is IngressNightmare?IngressNightmare is the name given to a series of vulnerabilities in the Ingress NGINX Controller for Kubernetes, an open source controller used for managing network traffic in Kubernetes clusters using NGINX as a reverse proxy and load balancer.What are the vulnerabilities associated with IngressNightmare?The following CVEs are associated with IngressNightmare:CVEDescriptionCVSSv3CVE-2025-1097Ingress NGINX Controller Configuration Injection via Unsanitized auth-tls-match-cn annotation8.8CVE-2025-1098Ingress NGINX Controller Configuration Injection via Unsanitized Mirror Annotations8.8CVE-2025-1974Ingress NGINX Admission Controller Remote Code Execution9.8CVE-2025-24513Ingress NGINX Controller Auth Secret File Path Traversal Vulnerability4.8CVE-2025-24514Ingress NGINX Controller Via Unsanitized Auth-URL Annotation8.8When was IngressNightmare first disclosed?Public disclosure of IngressNightmare happened on March 24 when news outlets, such as The Hacker News, began reporting on these vulnerabilities. At the time those articles were published, no patches were yet available from the Kubernetes team nor had a blog been published by the researchers who discovered these flaws.How critical are the IngressNightmare vulnerabilities?Based on the CVSS scores for these vulnerabilities, three are categorized as high severity, one is categorized as medium severity and one is categorized as critical severity.The most severe flaw, CVE-2025-1974, requires an unauthenticated remote attacker to be able to access the admission controller, a component in the Ingress NGINX Controller that has more privileged access within a Kubernetes cluster.Are the IngressNightmare vulnerabilities part of a toxic combination?Yes, the five vulnerabilities that make up IngressNightmare can be chained together as part of a toxic combination (or exploit chain). Successful exploitation of these flaws would grant an attacker the ability to access cluster secrets, which could result in a cluster takeover.Was this exploited as a zero-day?No, these vulnerabilities were reported to Kubernetes through coordinated disclosure.Is there a proof-of-concept (PoC) available for these vulnerabilities?As of March 24, there are no public proof-of-concept exploits for any of the five CVEs associated with IngressNightmare.Are patches or mitigations available for IngressNightmare?Yes, on the evening of March 24, the Kubernetes team published two fixed versions of Ingress NGINX Controller:Affected productAffected versionsFixed versionIngress NGINX Controller1.12.01.12.1Ingress NGINX Controller1.11.4 and below1.11.5Additionally, customers can use the following command to determine if clusters are using ingress-nginx:kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginxFor more specific information about mitigation steps, please refer to the Kubernetes blog.Does this also affect the NGINX Ingress Controller?No, while the names may sound similar, IngressNightmare does not affect the NGINX Ingress Controller from F5.Has Tenable released any product coverage for these vulnerabilities?A list of Tenable plugins for these vulnerabilities will be available on the individual CVE pages as they’re released:CVE-2025-1097CVE-2025-1098CVE-2025-1974CVE-2025-24513CVE-2025-24514Our Plugins Pipeline displays all available plugins for these vulnerabilities, including upcoming plugins, as they are added.Additional coverage is being investigated by Tenable Research and this blog post will be updated accordingly.Get more informationIngress-nginx CVE-2025-1974: What You Need to KnowIngressNightmare: Vulnerabilities in Ingress NGINXJoin Tenable's Security Response Team on the Tenable Community.Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.
Analysis Summary