CVE-2025-1097

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

35.53% chance of exploitation in the next 30 days, 98th percentile

Nuclei

high · CWE-20

Published

2025-03-24

Updated

2026-02-26

Proof-of-concept exploits (6)

• Esonhugh/ingressNightmare-CVE-2025-1974-exps98★ · 2025-05-06
• gian2dchris/ingress-nightmare-poc0★ · 2025-10-08
• hakaioffsec/IngressNightmare-PoC250★ · 2025-03-26
• lufeirider/IngressNightmare-PoC9★ · 2025-03-31
• salt318/CVE-2025-19740★ · 2025-04-27
• I3r1h0n/IngressNightterror

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1097.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52475

References

• CVE Record
• NVD entry

Related

• CVE-2018-1002105
• CVE-2025-1098
• CVE-2025-1974
• CVE-2025-24514
• CVE-2024-21338
• CVE-2025-49113