CVE-2025-1098

ingress-nginx controller - configuration injection via unsanitized mirror annotations

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

Affected

kubernetes · ingress-nginx

CVSS v3.1 LIGGITT

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

82.31% chance of exploitation in the next 30 days, 100th percentile

Nuclei

high · CWE-20

Published

2025-03-24

Updated

2026-02-26

Proof-of-concept exploits (6)

• Esonhugh/ingressNightmare-CVE-2025-1974-exps98★ · 2025-05-06
• gian2dchris/ingress-nightmare-poc0★ · 2025-10-08
• hakaioffsec/IngressNightmare-PoC248★ · 2025-03-26
• lufeirider/IngressNightmare-PoC9★ · 2025-03-31
• salt318/CVE-2025-19740★ · 2025-04-27
• I3r1h0n/IngressNightterror1★ · 2025-11-06

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1098.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52475

Security advisories

• advisories/GHSA-vg63-w3p9-jc9m

References

• CVE Record
• NVD entry

Related

• CVE-2018-1002105
• CVE-2025-1097
• CVE-2025-1974
• CVE-2025-24514
• CVE-2024-21338
• CVE-2025-49113