CVE-2025-1974

criticalpriority · attend · 45EPSS 0.994 · 100 %ileexploit · functionalDEEUNLRUUS
grimoire priorityP1 · Urgent
Exploitable?
Public exploit
26 exploits · functional
Likely / severe?
99.4% (100th) EPSS
CVSS 9.8 · critical
Is it mine?
291 products
Check your exposure
Who says so?
9 sources
cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-22

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedInsights Hub Private Cloudsiemens_psirt

    Contact customer support to receive patch and update information

  • Fixedrke2-1.34-0:1.34.3+rke2r1-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedrke2-1.34-0:1.34.3+rke2r1-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedrke2-1.34-0:1.34.3+rke2r1-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedrke2-1.34-0:1.34.3+rke2r1-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • FixedInsights Hub Private Cloudcisa_csaf_ot

    Contact customer support to receive patch and update information

02

cvss

Technical severity, 0–10. One row per scoring source.

9.8
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US
v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · jordan@liggitt.netexploitability 3.9 · impact 5.9
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Siemens ProductCERT DE
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · NCSC-NL NL
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-653USCWE-653USCWE-653USCWE-653USCWE-653USCWE-653US
05

exploits (26)

Public proof-of-concept and weaponised exploit code.

06

affected products (291)

Products and version ranges known to be affected.

showing 20 of 291
07

advisories (11)

Vendor and ecosystem advisories describing this.

  • NCSC-2025-0095Kwetsbaarheden verholpen in Kubernetes Ingress NGINX Controller NL2025-03-25csaf · ncsc_nlNL

    Kubernetes heeft een aantal kwetsbaarheden in de Ingress NGINX Controller verholpen. Deze kwetsbaarheden stellen kwaadwillenden in staat een ongeauthenticeerde remote code execution (RCE) uit voeren.

  • NCSC-2025-0106Kwetsbaarheden verholpen in Siemens productenNL2025-04-08csaf · ncsc_nlNL

    Siemens heeft kwetsbaarheden verholpen in diverse producten als Industrial Edge Devices, Mendix, SENTRON, SIDIS, SIMATIC, SIPLUS,Insights Hub Private Cloud, Siemens License Server en Solid Edge.

  • NCSC-2025-0124Kwetsbaarheden verholpen in Oracle CommunicationsNL2025-04-16csaf · ncsc_nlNL

    Oracle heeft meerdere kwetsbaarheden verholpen in Oracle Communications producten, waaronder de Cloud Native Core en Policy Management.

  • SSA-817234SSA-817234: Multiple Kubernetes Ingress NGINX Controller Vulnerabilities in Insights Hub Private Cloud2025-04-08csaf · siemens_psirtDE

    Insights Hub Private Cloud is affected by multiple vulnerabilities in Ingress NGINX Controller for Kubernetes. These vulnerabilities could lead to arbitrary code execution in the context of the ingress-nginx controller, or disclosure of Secrets accessible to the controller, or denial of service condition. Siemens has released a new version for Insights Hub Private Cloud and recommends to update to the latest version.

  • WID-SEC-W-2025-0629Ingress NGINX Controller für Kubernetes: Mehrere SchwachstellenDeutsch2025-03-24csaf · cert_bundDE

    Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen im Ingress NGINX Controller für Kubernetes ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand zu verursachen.

  • WID-SEC-W-2025-0823Oracle Communications: Mehrere SchwachstellenDeutsch2025-04-15csaf · cert_bundDE

    Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

  • WID-SEC-W-2025-1560Oracle Communications Applications: Mehrere SchwachstellenDeutsch2025-07-15csaf · cert_bundDE

    Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

  • openSUSE-SU-2026:10050-1rke2-1.34-1.34.3+rke2r1-1.1 on GA media2026-01-14csaf · suse_csafDE

    rke2-1.34-1.34.3+rke2r1-1.1 on GA media

  • GHSA-mgvx-rpfc-9mpvingress-nginx admission controller RCE escalation2025-03-25ghsa · osvUS

    A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

  • ICSA-25-100-05Siemens Insights Hub Private Cloud2025-04-08icsa · cisa_csaf_otUS

    Insights Hub Private Cloud is affected by multiple vulnerabilities in Ingress NGINX Controller for Kubernetes. These vulnerabilities could lead to arbitrary code execution in the context of the ingress-nginx controller, or disclosure of Secrets accessible to the controller, or denial of service condition. Siemens has released a new version for Insights Hub Private Cloud and recommends to update to the latest version.

  • GO-2025-3567ingress-nginx admission controller RCE escalation in k8s.io/ingress-nginx2025-03-25vendor · osvUS

    ingress-nginx admission controller RCE escalation in k8s.io/ingress-nginx. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: k8s.io/ingress-nginx before v1.11.5, from v1.12.0-beta.0 before v1.12.1.

08

also known as (6)

Other names and identifiers for this entity.

09

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bduosvcert_bundncsc_nlsiemens_psirtsuse_csafcisa_csaf_otNVDCVE.orgMITRE
published 2025-03-25modified 2026-06-17
10

references (12)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan