CVE-2025-24514
highPriorität · verfolgen · 21EPSS 0.305 · 98. PerzentilExploit · PoCDEEUNLRUUSEPSS · bewertet 2026-10-24
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenInsights Hub Private Cloudsiemens_psirt
Contact customer support to receive patch and update information
- BehobenInsights Hub Private Cloudcisa_csaf_ot
Contact customer support to receive patch and update information
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
Exploits (2)
Öffentlicher Proof-of-Concept- und Exploit-Code.
- KimJuhyeong95/cve-2025-24514KimJuhyeong95/cve-2025-24514PoC · poc_in_github
betroffene Produkte (109)
Betroffene Produkte und Versionsbereiche.
- IBM InfoSphere Information Serveralle Versionencert_bundDEcpe:/a:ibm:infosphere_information_server:-
Advisories (7)
Hersteller- und Ökosystem-Meldungen dazu.
- NCSC-2025-0095Kwetsbaarheden verholpen in Kubernetes Ingress NGINX Controller NL2025-03-25csaf · ncsc_nlNL
Kubernetes heeft een aantal kwetsbaarheden in de Ingress NGINX Controller verholpen. Deze kwetsbaarheden stellen kwaadwillenden in staat een ongeauthenticeerde remote code execution (RCE) uit voeren.
- NCSC-2025-0106Kwetsbaarheden verholpen in Siemens productenNL2025-04-08csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in diverse producten als Industrial Edge Devices, Mendix, SENTRON, SIDIS, SIMATIC, SIPLUS,Insights Hub Private Cloud, Siemens License Server en Solid Edge.
- SSA-817234SSA-817234: Multiple Kubernetes Ingress NGINX Controller Vulnerabilities in Insights Hub Private Cloud2025-04-08csaf · siemens_psirtDE
Insights Hub Private Cloud is affected by multiple vulnerabilities in Ingress NGINX Controller for Kubernetes. These vulnerabilities could lead to arbitrary code execution in the context of the ingress-nginx controller, or disclosure of Secrets accessible to the controller, or denial of service condition. Siemens has released a new version for Insights Hub Private Cloud and recommends to update to the latest version.
- WID-SEC-W-2025-0629Ingress NGINX Controller für Kubernetes: Mehrere SchwachstellenDeutsch2025-03-24csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen im Ingress NGINX Controller für Kubernetes ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand zu verursachen.
- GHSA-fwwp-xcxw-39vqingress-nginx controller - configuration injection via unsanitized auth-url annotation2025-03-25ghsa · osvUS
A security issue was discovered in [ingress-nginx](https://github.com/kubernetes/ingress-nginx) where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
- ICSA-25-100-05Siemens Insights Hub Private Cloud2025-04-08icsa · cisa_csaf_otUS
Insights Hub Private Cloud is affected by multiple vulnerabilities in Ingress NGINX Controller for Kubernetes. These vulnerabilities could lead to arbitrary code execution in the context of the ingress-nginx controller, or disclosure of Secrets accessible to the controller, or denial of service condition. Siemens has released a new version for Insights Hub Private Cloud and recommends to update to the latest version.
- GO-2025-3566ingress-nginx controller - configuration injection via unsanitized auth-url annotation in k8s.io/ingress-nginx2025-03-25vendor · osvUS
ingress-nginx controller - configuration injection via unsanitized auth-url annotation in k8s.io/ingress-nginx. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: k8s.io/ingress-nginx before v1.11.5, from v1.12.0-beta.0 before v1.12.1.
auch bekannt als (6)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (8)
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.12.1Patchcnnvd
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24514cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2025-24514cnnvd
- https://www.exploit-db.com/exploits/52475cnnvd
- https://github.com/kubernetes/kubernetes/issues/131006enisa_euvd
- https://github.com/kubernetes/kubernetes/issues/131006nvd
- https://security.netapp.com/advisory/ntap-20250328-0008/nvd
- https://www.exploit-db.com/exploits/52475nvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan