# CVE-2025-1974

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

- Page: https://www.vulneraibility.com/cve/CVE-2025-1974
- CVSS: 9.8
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 99.40% (percentile 99.9)
- Public exploit code: 2 on Exploit-DB · 25 GitHub proofs of concept · 1 Nuclei template (first 2025-03-24)
- CISA SSVC: exploitation poc, automatable yes, technical impact total (assessed 2025-03-27)
- Weakness: CWE-653
- Published: 2025-03-25

## Affected versions

- kubernetes ingress-nginx: affected <= 1.11.4; 1.12.0

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://https://github.com/kubernetes/kubernetes/issues/131009
- [other] https://security.netapp.com/advisory/ntap-20250328-0008/
- [other] https://github.com/B1ack4sh/Blackash-CVE-2025-1974
- [other] https://www.exploit-db.com/exploits/52475

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.