CVE-2025-24514
highpriority · track · 21EPSS 0.305 · 98 %ileexploit · PoCDEEUNLRUUSEPSS · scored 2026-10-24
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedInsights Hub Private Cloudsiemens_psirt
Contact customer support to receive patch and update information
- FixedInsights Hub Private Cloudcisa_csaf_ot
Contact customer support to receive patch and update information
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (2)
Public proof-of-concept and weaponised exploit code.
- KimJuhyeong95/cve-2025-24514KimJuhyeong95/cve-2025-24514PoC · poc_in_github
affected products (109)
Products and version ranges known to be affected.
advisories (7)
Vendor and ecosystem advisories describing this.
- NCSC-2025-0095Kwetsbaarheden verholpen in Kubernetes Ingress NGINX Controller NL2025-03-25csaf · ncsc_nlNL
Kubernetes heeft een aantal kwetsbaarheden in de Ingress NGINX Controller verholpen. Deze kwetsbaarheden stellen kwaadwillenden in staat een ongeauthenticeerde remote code execution (RCE) uit voeren.
- NCSC-2025-0106Kwetsbaarheden verholpen in Siemens productenNL2025-04-08csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in diverse producten als Industrial Edge Devices, Mendix, SENTRON, SIDIS, SIMATIC, SIPLUS,Insights Hub Private Cloud, Siemens License Server en Solid Edge.
- SSA-817234SSA-817234: Multiple Kubernetes Ingress NGINX Controller Vulnerabilities in Insights Hub Private Cloud2025-04-08csaf · siemens_psirtDE
Insights Hub Private Cloud is affected by multiple vulnerabilities in Ingress NGINX Controller for Kubernetes. These vulnerabilities could lead to arbitrary code execution in the context of the ingress-nginx controller, or disclosure of Secrets accessible to the controller, or denial of service condition. Siemens has released a new version for Insights Hub Private Cloud and recommends to update to the latest version.
- WID-SEC-W-2025-0629Ingress NGINX Controller für Kubernetes: Mehrere SchwachstellenDeutsch2025-03-24csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen im Ingress NGINX Controller für Kubernetes ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand zu verursachen.
- GHSA-fwwp-xcxw-39vqingress-nginx controller - configuration injection via unsanitized auth-url annotation2025-03-25ghsa · osvUS
A security issue was discovered in [ingress-nginx](https://github.com/kubernetes/ingress-nginx) where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
- ICSA-25-100-05Siemens Insights Hub Private Cloud2025-04-08icsa · cisa_csaf_otUS
Insights Hub Private Cloud is affected by multiple vulnerabilities in Ingress NGINX Controller for Kubernetes. These vulnerabilities could lead to arbitrary code execution in the context of the ingress-nginx controller, or disclosure of Secrets accessible to the controller, or denial of service condition. Siemens has released a new version for Insights Hub Private Cloud and recommends to update to the latest version.
- GO-2025-3566ingress-nginx controller - configuration injection via unsanitized auth-url annotation in k8s.io/ingress-nginx2025-03-25vendor · osvUS
ingress-nginx controller - configuration injection via unsanitized auth-url annotation in k8s.io/ingress-nginx. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: k8s.io/ingress-nginx before v1.11.5, from v1.12.0-beta.0 before v1.12.1.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.12.1Patchcnnvd
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24514cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2025-24514cnnvd
- https://www.exploit-db.com/exploits/52475cnnvd
- https://github.com/kubernetes/kubernetes/issues/131006enisa_euvd
- https://github.com/kubernetes/kubernetes/issues/131006nvd
- https://security.netapp.com/advisory/ntap-20250328-0008/nvd
- https://www.exploit-db.com/exploits/52475nvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan