{"id":"CVE-2025-1097","aliases":["EUVD-2025-8034","GHSA-823x-fv5p-h7hw","GO-2025-3565","openSUSE-SU-2025:14937-1"],"status":"published","title":"ingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation","description":"A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.3696,"percentile":0.98524,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-15","CWE-20"],"published":"2025-03-24T23:29:05Z","modified":"2026-10-28T02:31:12Z","exploits":[{"source":"pocgithub","id":"hakaioffsec/IngressNightmare-PoC","title":"hakaioffsec/IngressNightmare-PoC","date":"2025-03-26","url":"https://github.com/hakaioffsec/IngressNightmare-PoC"},{"source":"pocgithub","id":"lufeirider/IngressNightmare-PoC","title":"lufeirider/IngressNightmare-PoC","date":"2025-03-30","url":"https://github.com/lufeirider/IngressNightmare-PoC"},{"source":"exploitdb","id":"EDB-52475","title":"Ingress-NGINX Admission Controller v1.11.1 - FD Injection to RCE","type":"remote","platform":"multiple","date":"2026-02-04","url":"https://www.exploit-db.com/exploits/52475"},{"source":"nuclei","id":"CVE-2025-1097","title":"Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-tls-match-cn` Annotation","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1097.yaml"}],"fixes":[{"ecosystem":"Go","package":"k8s.io/ingress-nginx","fixed_in":["1.11.5","1.12.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"k8s.io/ingress-nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.5"}]}]},{"source":"ghsa","ecosystem":"Go","package":"k8s.io/ingress-nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0-beta.0"},{"fixed":"1.12.1"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/ingress-nginx","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.5"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/ingress-nginx","ranges":[{"type":"SEMVER","events":[{"introduced":"1.12.0-beta.0"},{"fixed":"1.12.1"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/ingress-nginx","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250327T184518-1.1"}]}],"bundled":30}],"products":[{"vendor":"kubernetes","product":"ingress-nginx"}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/131007","tags":["report","web"]},{"url":"https://security.netapp.com/advisory/ntap-20250328-0008/","tags":["advisory"]},{"url":"https://www.exploit-db.com/exploits/52475","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1097","tags":["advisory"]},{"url":"https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.11.5","tags":["web"]},{"url":"https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.12.1","tags":["web"]},{"url":"https://groups.google.com/g/kubernetes-security-announce/c/2qa9DFtN0cQ","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20250328-0008","tags":["web"]},{"url":"https://github.com/advisories/GHSA-823x-fv5p-h7hw","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/1xxx/CVE-2025-1097.json","tags":["advisory"]},{"url":"https://github.com/kubernetes/ingress-nginx","tags":["package"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NEVFAGUWHTVZSJTUAIU6C4S26DP2KIGB/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27612","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30204","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-1097","title":"ingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation","description":"A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)","status":"published","published":"2025-03-24T23:29:05.879Z","modified":"2026-02-26T19:09:14.028Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:32:49.503917Z"}],"euvd":[{"id":"EUVD-2025-8034","description":"A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)","status":"published","published":"2025-03-24T23:29:05Z","modified":"2026-02-26T19:09:14Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:15.753271Z"}],"ghsa":[{"id":"GHSA-823x-fv5p-h7hw","title":"ngress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation","description":"A security issue was discovered in [ingress-nginx](https://github.com/kubernetes/ingress-nginx) where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)","status":"published","published":"2025-03-25T00:30:26Z","modified":"2025-11-03T21:33:14Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-15","CWE-20"],"updated_at":"2026-11-02T14:39:04.350802Z"}],"nvd":[{"id":"CVE-2025-1097","description":"A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)","status":"published","published":"2025-03-25T00:15:13.59Z","modified":"2026-06-17T08:38:22.777Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:10:55.858901Z"}],"osv":[{"id":"CVE-2025-1097","title":"ingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation","description":"A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)","status":"published","published":"2025-03-24T23:29:05.879Z","modified":"2026-10-28T02:31:12.844552997Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:44:46.024537Z"},{"id":"GHSA-823x-fv5p-h7hw","title":"ngress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation","description":"A security issue was discovered in [ingress-nginx](https://github.com/kubernetes/ingress-nginx) where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)","status":"published","published":"2025-03-25T00:30:26Z","modified":"2026-09-10T03:49:48.411809133Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-15","CWE-20"],"updated_at":"2026-11-02T15:46:41.732368Z"},{"id":"GO-2025-3565","title":"ngress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation in k8s.io/ingress-nginx","description":"ngress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation in k8s.io/ingress-nginx.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: k8s.io/ingress-nginx before v1.11.5, from v1.12.0-beta.0 before v1.12.1.","status":"published","published":"2025-03-25T19:38:11Z","modified":"2026-05-20T08:11:44.091946535Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:14937-1","title":"govulncheck-vulndb-0.0.20250327T184518-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250327T184518-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-03-28T00:00:00Z","modified":"2026-02-04T02:21:10.797539Z","updated_at":"2026-11-02T16:58:37.399567Z"}]}}