Skip to content
CVE IDCVE-2025-1974GitHub advisory IDGHSA-mgvx-rpfc-9mpv

ingress-nginx admission controller RCE escalation

CVE-2025-1974 (GitHub advisory GHSA-mgvx-rpfc-9mpv) is a critical-severity vulnerability with a CVSS 3.1 base score of 9.8, classed as Improper Isolation or Compartmentalization (CWE-653), in k8s.io/ingress-nginx (Go). Affected versions: < 1.11.5; >= 1.12.0-beta.0, < 1.12.1. It is fixed in 1.11.5 or 1.12.1, depending on the release line.

Critical9.8Fix availableGitHub reviewed

Published 24 Mar 2025Updated 26 Feb 2026

9.8CriticalCVSS 3.1
CVE ID
CVE-2025-1974
GHSA ID
GHSA-mgvx-rpfc-9mpv
EPSS
99.52%higher than 99.9% of CVEs
Weakness (CWE)
  • CWE-653Improper Isolation or Compartmentalization
KEV status
Not in KEV
Published
24 Mar 2025
Updated
26 Feb 2026
Ecosystem
  • Go
Assigned by (CNA)
kubernetes

Summary

Source: OSV (GitHub advisory)

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

Technical details

Source: GitHub Advisory Database

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Critical9.8Base score from GitHub Advisory Database

Attack Vector AV
Network
Attack Complexity AC
Low
Privileges Required PR
None
User Interaction UI
None
Scope S
Unchanged
Confidentiality C
High
Integrity I
High
Availability A
High

CISA SSVC decision points

Exploitation
poc
Proof-of-concept code is public
Automatable
yes
Attackers can automate this at scale
Technical impact
total
Full control of the affected system

CISA Coordinator assessment (SSVC 2.0.3) via CVE.org.

Affected packages

Source: OSV (GitHub advisory)

  • k8s.io/ingress-nginx
    Go
    pkg:golang/k8s.io/ingress-nginx
    Affected versions
    < 1.11.5
    >= 1.12.0-beta.0, < 1.12.1
    Fixed in
    1.11.5
    1.12.1

Fix

Source: OSV (GitHub advisory)

Fix available

Upgrade to 1.11.5 or 1.12.1, depending on your release line.

Vulnerability intelligence

References

Credits

  • dor-hayunanalyst
  • Nir Ohfeldfinder
  • Ronen Shustinfinder
  • Sagi Tzadikfinder
  • Hillai Ben Sassonfinder

Questions about CVE-2025-1974

What is the GHSA ID for CVE-2025-1974?
GitHub tracks CVE-2025-1974 as GHSA-mgvx-rpfc-9mpv.
What is the CVSS score of CVE-2025-1974?
CVE-2025-1974 has a CVSS 3.1 base score of 9.8 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Which versions are affected by CVE-2025-1974?
k8s.io/ingress-nginx (Go): < 1.11.5; >= 1.12.0-beta.0, < 1.12.1.
How do I fix CVE-2025-1974?
Upgrade to 1.11.5 or 1.12.1, depending on the release line.
What is the Package URL (PURL) for CVE-2025-1974?
The affected package's PURL is pkg:golang/k8s.io/ingress-nginx.
Is CVE-2025-1974 exploited in the wild?
CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2025-1974. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "poc". EPSS estimates a 99.52% chance of exploitation in the next 30 days, higher than 99.9% of CVEs.

Data sources

Upstream records

  • OSV (GitHub advisory)LoadedRaw JSON
  • GitHub Advisory DatabaseLoadedRaw JSON
  • OSV (CVE record)LoadedRaw JSON
  • CVE.orgLoaded
  • CISA KEV catalogLoaded

Fetched 1 day ago (15 Oct 2026, 04:37 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
OSV (GitHub advisory)
Severity score
GitHub Advisory Database
Weakness (CWE)
GitHub Advisory Database
Affected packages
OSV (GitHub advisory)
Fix
OSV (GitHub advisory)
References
Computed by CVEminer
SSVC
CVE.org
KEV status
CISA KEV catalog
EPSS
GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.