{"id":"CVE-2025-24514","aliases":["EUVD-2025-8031","GHSA-fwwp-xcxw-39vq","GO-2025-3566","openSUSE-SU-2025:14937-1"],"status":"published","title":"ingress-nginx controller - configuration injection via unsanitized auth-url annotation","description":"A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.37282,"percentile":0.98544,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-15","CWE-20"],"published":"2025-03-24T23:29:36Z","modified":"2026-10-28T02:30:59Z","exploits":[{"source":"pocgithub","id":"KimJuhyeong95/cve-2025-24514","title":"KimJuhyeong95/cve-2025-24514","date":"2025-06-11","url":"https://github.com/KimJuhyeong95/cve-2025-24514"},{"source":"exploitdb","id":"EDB-52475","title":"Ingress-NGINX Admission Controller v1.11.1 - FD Injection to RCE","type":"remote","platform":"multiple","date":"2026-02-04","url":"https://www.exploit-db.com/exploits/52475"},{"source":"nuclei","id":"CVE-2025-24514","title":"Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-url` Annotation","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-24514.yaml"}],"fixes":[{"ecosystem":"Go","package":"k8s.io/ingress-nginx","fixed_in":["1.11.5","1.12.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"k8s.io/ingress-nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.5"}]}]},{"source":"ghsa","ecosystem":"Go","package":"k8s.io/ingress-nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0-beta.0"},{"fixed":"1.12.1"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/ingress-nginx","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.5"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/ingress-nginx","ranges":[{"type":"SEMVER","events":[{"introduced":"1.12.0-beta.0"},{"fixed":"1.12.1"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/ingress-nginx","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250327T184518-1.1"}]}],"bundled":30}],"products":[{"vendor":"kubernetes","product":"ingress-nginx"}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/131006","tags":["report","web"]},{"url":"https://security.netapp.com/advisory/ntap-20250328-0008/","tags":["advisory"]},{"url":"https://www.exploit-db.com/exploits/52475","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24514","tags":["advisory"]},{"url":"https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.11.5","tags":["web"]},{"url":"https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.12.1","tags":["web"]},{"url":"https://groups.google.com/g/kubernetes-security-announce/c/2qa9DFtN0cQ","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20250328-0008","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fwwp-xcxw-39vq","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24514.json","tags":["advisory"]},{"url":"https://github.com/kubernetes/ingress-nginx","tags":["package"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NEVFAGUWHTVZSJTUAIU6C4S26DP2KIGB/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27612","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30204","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-24514","title":"ingress-nginx controller - configuration injection via unsanitized auth-url annotation","description":"A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)","status":"published","published":"2025-03-24T23:29:36.802Z","modified":"2026-02-26T19:09:12.808Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:32:44.11109Z"}],"euvd":[{"id":"EUVD-2025-8031","description":"A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)","status":"published","published":"2025-03-24T23:29:36Z","modified":"2026-02-26T19:09:12Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:15.753271Z"}],"ghsa":[{"id":"GHSA-fwwp-xcxw-39vq","title":"ingress-nginx controller - configuration injection via unsanitized auth-url annotation","description":"A security issue was discovered in [ingress-nginx](https://github.com/kubernetes/ingress-nginx) where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)","status":"published","published":"2025-03-25T00:30:26Z","modified":"2026-02-04T21:49:30Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-15","CWE-20"],"updated_at":"2026-11-02T14:39:22.637668Z"}],"nvd":[{"id":"CVE-2025-24514","description":"A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)","status":"published","published":"2025-03-25T00:15:15.047Z","modified":"2026-06-17T08:59:09.137Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:10:55.858901Z"}],"osv":[{"id":"CVE-2025-24514","title":"ingress-nginx controller - configuration injection via unsanitized auth-url annotation","description":"A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)","status":"published","published":"2025-03-24T23:29:36.802Z","modified":"2026-10-28T02:30:59.794804387Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:44:47.386092Z"},{"id":"GHSA-fwwp-xcxw-39vq","title":"ingress-nginx controller - configuration injection via unsanitized auth-url annotation","description":"A security issue was discovered in [ingress-nginx](https://github.com/kubernetes/ingress-nginx) where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)","status":"published","published":"2025-03-25T00:30:26Z","modified":"2026-09-10T03:49:48.479802241Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-15","CWE-20"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"GO-2025-3566","title":"ingress-nginx controller - configuration injection via unsanitized auth-url annotation in k8s.io/ingress-nginx","description":"ingress-nginx controller - configuration injection via unsanitized auth-url annotation in k8s.io/ingress-nginx.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: k8s.io/ingress-nginx before v1.11.5, from v1.12.0-beta.0 before v1.12.1.","status":"published","published":"2025-03-25T19:38:11Z","modified":"2026-05-20T08:11:45.49813407Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:14937-1","title":"govulncheck-vulndb-0.0.20250327T184518-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250327T184518-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-03-28T00:00:00Z","modified":"2026-02-04T02:21:10.797539Z","updated_at":"2026-11-02T16:58:37.399567Z"}]}}