Ingress-nginx CVE-2025-1974: What It Is and How to Fix It

CVE-2025-1974 (IngressNightmare) is a critical RCE flaw in ingress-nginx affecting 40%+ of clusters. Learn how to detect and patch it.

March 25, 2025

Abhimanyu Saharan

Today, when I woke up and checked my RSS feed, one headline stood out immediately, CVE-2025-1974. It’s a new high-severity vulnerability in , and it’s bad. Like bad.

Loading…

ingress-nginx

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: allow-get-kubernetes-endpoint
  namespace: default
rules:
  - apiGroups: [""]
    resources: ["endpoints"]
    resourceNames: ["kubernetes"]
    verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: allow-get-kubernetes-endpoint-binding
  namespace: default
subjects:
  - kind: ServiceAccount
    name: default
    namespace: kube-system
roleRef:
  kind: Role
  name: allow-get-kubernetes-endpoint
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: webhook-port-blocker
  namespace: kube-system
  labels:
    app: webhook-port-blocker
spec:
  selector:
    matchLabels:
      app: webhook-port-blocker
  template:
    metadata:
      labels:
        app: webhook-port-blocker
    spec:
      hostNetwork: true
      serviceAccountName: default
      volumes:
        - name: shared
          emptyDir: {}
        - name: sa-token
          projected:
            sources:
              - serviceAccountToken:
                  path: token
                  expirationSeconds: 3600
              - configMap:
                  name: kube-root-ca.crt
              - downwardAPI:
                  items:
                    - path: namespace
                      fieldRef:
                        fieldPath: metadata.namespace
      initContainers:
        - name: fetch-apiserver-ips
          image: bitnami/kubectl:1.20
          command:
            - sh
            - -c
            - |
              echo "[+] Fetching all Kubernetes API server IPs..."
              kubectl get endpoints kubernetes -n default -o jsonpath='{.subsets[0].addresses[*].ip}' | tr ' ' '\n' > /shared/apiserver-ips

              echo "[+] IPs written to /shared/apiserver-ips:"
              cat /shared/apiserver-ips
          volumeMounts:
            - name: shared
              mountPath: /shared
            - name: sa-token
              mountPath: /var/run/secrets/kubernetes.io/serviceaccount
              readOnly: true
      containers:
        - name: iptables
          image: alpine:3.19
          securityContext:
            privileged: true
          command:
            - sh
            - -c
            - |
              apk add --no-cache iptables ipset >/dev/null

              echo "[+] Waiting for /shared/apiserver-ips..."
              while [ ! -s /shared/apiserver-ips ]; do sleep 1; done

              echo "[+] Creating or flushing ipset 'apiserver-ips'..."
              ipset create apiserver-ips hash:ip 2>/dev/null || ipset flush apiserver-ips

              echo "[+] Adding allowed IPs to ipset..."
              while read -r IP; do
                ipset add apiserver-ips "$IP" 2>/dev/null || true
              done < /shared/apiserver-ips

              echo "[+] Inserting new iptables rule using ipset..."
              iptables -I INPUT -p tcp --dport 8443 -m set ! --match-set apiserver-ips src -j DROP

              echo "[+] Final iptables rules:"
              iptables -L INPUT -n --line-numbers | grep 8443

              tail -f /dev/null
          volumeMounts:
            - name: shared
              mountPath: /shared
          resources:
            requests:
              cpu: 25m
              memory: 32Mi
            limits:
              cpu: 100m
              memory: 64Mi
      tolerations:
        - operator: Exists