Critical Kubernetes Controller Flaws: 4,000 IPs Exposed

Thousands of Kubernetes clusters are not patched against a combination of five critical vulnerabilities detailed publicly on Monday that could allow attackers to take control of cloud-based applications.

See Also: Enhance Cloud Security with AI-Driven Technologies

The Kubernetes project team released patches for the Ingress Nginx Controller in the form of “ingress-nginx v1.12.1 and v1.11.5, which have fixes for all five of these vulnerabilities,” urging users to immediately update (see: Kubernetes Patch: 43% of Clusters Face Remote Takeover Risk).

Kubernetes is a popular open-source platform for managing containerized workloads and services. The system automates everything from software deployment to scaling and management.

The vulnerabilities exist in the admission controller component of the Ingress Nginx Controller, which is maintained by the core Kubernetes team and based on the popular Nginx – pronounced “engine x” – HTTP web server, reverse proxy and load-balancing software.

Many Kubernetes projects rely on the controller. “Because of its versatility and ease of use, ingress-nginx is quite popular: it is deployed in over 40% of Kubernetes clusters,” said Tabitha Sable, who’s part of the Kubernetes Security Response Committee, in a security alert.

The vulnerabilities are tracked as CVE-2025-24513, CVE-2025-24514, CVE-2025-1097 and CVE-2025-1098, as well as CVE-2025-1974, which is the most serious, with “critical” CVSS severity rating of 9.8 of out 10. Should attackers exploit the flaws, “anything on the Pod network” – inside the cluster – “has a good chance of taking over your Kubernetes cluster, with no credentials or administrative access required,” and gaining access to all secrets being stored, Sable said.

“In many common scenarios, the Pod network is accessible to all workloads in your cloud VPC” – virtual private cloud – “or even anyone connected to your corporate network,” she said. “This is a very serious situation.”

More details continue to emerge about the flaws and how they might be exploited via in-the-wild attacks for remote code execution – although researchers so far report seeing no signs of such attacks in the wild.

“Of the five vulnerabilities disclosed, any one of the injection vulnerabilities” – CVE-2025-24514, CVE-2025-1097 or CVE-2025-1098 – “may be chained with CVE-2025-1974 to achieve unauthenticated RCE on the Kubernetes pod that is running a vulnerable Ingress Nginx Controller,” said Stephen Fewer, a principal security researcher at Rapid7, in a blog post. “Achieving RCE could allow an attacker to take over a Kubernetes cluster.”

Researchers at cloud security firm Wiz discovered and reported the vulnerabilities to Kubernetes, and helped refine the patches. On Monday, Wiz published its own, coordinated vulnerability disclosure. At that time, the firm reported seeing 43% of Kubernetes cloud environments sporting what it’s dubbed the “IngressNightmare” flaws, saying 6,500 clusters had publicly exposed Ingress Nginx Controllers.

Attack surface management firm Censys on Tuesday reported seeing just under 5,000 hosts, including virtual hosts, exposing their Nginx ingress controller directly to the internet, which is said makes them “potentially” vulnerable to the exploit.

On Thursday, the Shadowserver Foundation reported seeing “around 4,000 IPs exposed,” which it’s tracking as “possible-cve-2025-1974.” As that nomenclature highlights, exposing the service doesn’t reveal if the controller has yet been patched, but multiple researchers have warned that such exposure is an unsafe practice.

“Ingress controllers should never be exposed to the internet like this, exploitable or not,” Censys said.

Here’s why: Kubernetes controllers generate, on the fly, a new configuration for how to control traffic, based on “an ‘AdmissionReview’ request and a configuration template” supplied by anyone with access to the controller, Censys said. “This means that if you have the right network access and the ability to submit one of these admission review requests, you could get the controller to generate a ‘malicious’ Nginx configuration.”

As of Tuesday, at least one such exploit for CVE-2025-1974 was published that can be used remotely execute code. “This exploit is unverified, but based on our understanding of the vulnerability, it appears viable,” Rapid7’s Fewer said.