VYPR
← All advisories
Critical severity9.8GHSA Advisory· Published Mar 25, 2025· Updated Apr 15, 2026

CVE-2025-1974

CVE-2025-1974

Description

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
k8s.io/ingress-nginxGo
< 1.11.51.11.5
k8s.io/ingress-nginxGo
>= 1.12.0-beta.0, < 1.12.11.12.1

Affected products

79

Patches

Vulnerability mechanics

References

10

News mentions

1