{"id":"CVE-2025-1098","aliases":["EUVD-2025-8033","GHSA-vg63-w3p9-jc9m","GO-2025-3568","openSUSE-SU-2025:14937-1"],"status":"published","title":"ingress-nginx controller - configuration injection via unsanitized mirror annotations","description":"A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.86146,"percentile":0.99733,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-15","CWE-20"],"published":"2025-03-24T23:29:15Z","modified":"2026-10-28T02:30:32Z","exploits":[{"source":"exploitdb","id":"EDB-52475","title":"Ingress-NGINX Admission Controller v1.11.1 - FD Injection to RCE","type":"remote","platform":"multiple","date":"2026-02-04","url":"https://www.exploit-db.com/exploits/52475"},{"source":"nuclei","id":"CVE-2025-1098","title":"Ingress-Nginx Controller - Configuration Injection via Unsanitized Mirror Annotations","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-1098.yaml"}],"fixes":[{"ecosystem":"Go","package":"k8s.io/ingress-nginx","fixed_in":["1.11.5","1.12.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"k8s.io/ingress-nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.5"}]}]},{"source":"ghsa","ecosystem":"Go","package":"k8s.io/ingress-nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0-beta.0"},{"fixed":"1.12.1"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/ingress-nginx","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.5"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/ingress-nginx","ranges":[{"type":"SEMVER","events":[{"introduced":"1.12.0-beta.0"},{"fixed":"1.12.1"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/ingress-nginx","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250327T184518-1.1"}]}],"bundled":30}],"products":[{"vendor":"kubernetes","product":"ingress-nginx"}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/131008","tags":["report","web"]},{"url":"https://security.netapp.com/advisory/ntap-20250328-0008/","tags":["advisory"]},{"url":"https://www.exploit-db.com/exploits/52475","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1098","tags":["advisory"]},{"url":"https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.11.5","tags":["web"]},{"url":"https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.12.1","tags":["web"]},{"url":"https://groups.google.com/g/kubernetes-security-announce/c/2qa9DFtN0cQ","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20250328-0008","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vg63-w3p9-jc9m","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/1xxx/CVE-2025-1098.json","tags":["advisory"]},{"url":"https://github.com/kubernetes/ingress-nginx","tags":["package"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NEVFAGUWHTVZSJTUAIU6C4S26DP2KIGB/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27612","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30204","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-1098","title":"ingress-nginx controller - configuration injection via unsanitized mirror annotations","description":"A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)","status":"published","published":"2025-03-24T23:29:15.61Z","modified":"2026-02-26T19:09:13.28Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:32:49.503917Z"}],"euvd":[{"id":"EUVD-2025-8033","description":"A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)","status":"published","published":"2025-03-24T23:29:15Z","modified":"2026-02-26T19:09:13Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:15.753271Z"}],"ghsa":[{"id":"GHSA-vg63-w3p9-jc9m","title":"ingress-nginx controller - configuration injection via unsanitized mirror annotations","description":"A security issue was discovered in [ingress-nginx](https://github.com/kubernetes/ingress-nginx) where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)","status":"published","published":"2025-03-25T00:30:26Z","modified":"2025-11-03T21:33:13Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-15","CWE-20"],"updated_at":"2026-11-02T14:39:04.350802Z"}],"nvd":[{"id":"CVE-2025-1098","description":"A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)","status":"published","published":"2025-03-25T00:15:14.613Z","modified":"2026-06-17T08:38:22.883Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:10:55.858901Z"}],"osv":[{"id":"CVE-2025-1098","title":"ingress-nginx controller - configuration injection via unsanitized mirror annotations","description":"A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)","status":"published","published":"2025-03-24T23:29:15.61Z","modified":"2026-10-28T02:30:32.424011575Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:44:46.024537Z"},{"id":"GHSA-vg63-w3p9-jc9m","title":"ingress-nginx controller - configuration injection via unsanitized mirror annotations","description":"A security issue was discovered in [ingress-nginx](https://github.com/kubernetes/ingress-nginx) where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)","status":"published","published":"2025-03-25T00:30:26Z","modified":"2026-09-10T03:49:48.419929762Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-15","CWE-20"],"updated_at":"2026-11-02T15:46:57.348035Z"},{"id":"GO-2025-3568","title":"ingress-nginx controller - configuration injection via unsanitized mirror annotations in k8s.io/ingress-nginx","description":"ingress-nginx controller - configuration injection via unsanitized mirror annotations in k8s.io/ingress-nginx.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: k8s.io/ingress-nginx before v1.11.5, from v1.12.0-beta.0 before v1.12.1.","status":"published","published":"2025-03-25T19:38:11Z","modified":"2026-05-20T08:11:45.285750175Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:14937-1","title":"govulncheck-vulndb-0.0.20250327T184518-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250327T184518-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-03-28T00:00:00Z","modified":"2026-02-04T02:21:10.797539Z","updated_at":"2026-11-02T16:58:37.399567Z"}]}}