CVE-2025-1974

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-653

Affected software

Vendor	Product	Versions
kubernetes	ingress-nginx	<= 1.11.4; 1.12.0

References

Timeline

Published: Mar 25, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-19757.5A vulnerability in the Ollama server version 0.5.11 allows a malicious user to cause a Denial of Service (DoS) attack by customizing the man CVE-2025-19766.7Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute CVE-2025-19777.7The NPort 6100-G2/6200-G2 Series is affected by an execution with unnecessary privileges vulnerability (CVE-2025-1977) that allows an authen CVE-2025-19789.8Remote Code Execution Vulnerability in Hitachi Storage Navigator and the maintenance console in Hitachi Virtual Storage Platform G130, G150,CVE-2025-19796.4Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is bei CVE-2025-19809.4The Ready_ application's Profile section allows users to upload files of any type and extension without restriction. If the server is miscon CVE-2025-19819.4Improper neutralization of input provided by a low-privileged user into a file search functionality in Ready_'s Invoices module allows for S CVE-2025-19827.1Local File Inclusion vulnerability in Ready's attachment upload panel allows low privileged user to provide link to a local file using the f CVE-2025-19835.1A cross-site scripting (XSS) vulnerability in Ready_'s File Explorer upload functionality allows injection of arbitrary JavaScript code in f CVE-2025-19845.2Xerox Desktop Print Experience application contains a Local Privilege Escalation (LPE) vulnerability, which allows a low-privileged user to CVE-2025-19856.1Due to improper neutralization of input during web page generation (XSS) an unauthenticated remote attacker can inject HTML code into the We CVE-2025-19864.1The Gutentor WordPress plugin before 3.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to