CVE-2025-1097, CVE-2025-1098, and Other Vulnerabilities Fix Announcement
The Kubernetes community has reported several security vulnerabilities related to Nginx Ingress, including CVE-2025-1097, CVE-2025-1098, CVE-2025-1974, CVE-2025-24513, CVE-2025-24514, among others.
Vulnerability details
| Vulnerability ID | Vulnerability level | Vulnerability description |
|---|---|---|
| CVE-2025-1097 | High-risk vulnerability | Attackers with write permissions for ingress resources can exploit the Nginx Ingress community's auth-tls-match-cn Annotation to inject malicious configurations into Nginx, execute arbitrary code within the ingress-nginx controller context, and access cluster-wide secrets. |
| CVE-2025-1098 | High-risk vulnerability | Attackers with write permissions for ingress resources can exploit the Nginx Ingress community's mirror-target and mirror-host Annotation to inject malicious configurations into Nginx, execute arbitrary code within the ingress-nginx controller context, and access cluster-wide secrets. |
| CVE-2025-1974 | High-risk vulnerability | Under specific conditions, attackers with access to the cluster intranet can exploit Nginx Ingress's ValidatingAdmissionWebhook to inject configurations, execute arbitrary code in the ingress-nginx controller context, and gain access to cluster-wide secrets. |
| CVE-2025-24513 | Medium-risk vulnerability | The Nginx Ingress Controller insufficiently validates or filters data submitted by attackers with write permissions for ingress resources. Exploiting this vulnerability, attackers can craft malicious requests to inject invalid data into the configuration file generation path, triggering directory traversal vulnerabilities. This can result in denial of service or, when combined with other vulnerabilities, cluster-wide limited secret leakage. |
| CVE-2025-24514 | High-risk vulnerability | Attackers with write permissions for ingress resources can exploit the auth-url Annotation provided by the Nginx Ingress community to inject configurations into Nginx, execute arbitrary code within the ingress-nginx controller context, and access cluster-wide secrets. |
Scope of impact
The affected versions of the open-source NGINX Ingress controller are as follows:
- <v1.11.5
- v1.12.0
The following versions of the open-source NGINX Ingress controller fixed this problem:
- v1.11.5
- v1.12.1
Judgment method
Clusters not installed the CCE Ingress Nginx Controller are not affected by the above vulnerabilities. You can refer to the following to check whether the component is installed in the cluster. For component version release notes, refer toCCE Ingress NGINX Controller Description.
Description:
Cloud Container Engine (CCE) has resolved the Nginx Ingress security vulnerabilities. Instances created using the CCE Ingress Nginx Controller after April 2, 2025, are not impacted.
Method 1:
- Sign in to the Baidu AI Cloud Console and select the Cluster List from the navigation bar at the left side.
- In the Cluster List, click the name of your target cluster. Then, from the left navigation menu, go to Operations and Management > Component Management.
- On the Component Management page, locate the CCE Ingress Nginx Controller. Check if the component is installed and ensure it is updated to the latest version on the component card.
Method 2:
- Log in to the Baidu AI Cloud CCE Console, and from the left navigation bar, choose Helm > Helm Instance.
- On the Helm Instance page, select the target cluster to verify whether instances deployed using the cce-ingress-nginx-controller template are present, and check if the template version matches the current CCE Ingress Nginx Controller version.
Fix solution
Before upgrading the component to a vulnerability-patched version, you can temporarily disable the Admission Webhook function of the CCE Ingress Nginx Controller to reduce risk.
- Sign in to Baidu AI Cloud CCE Console, select Helm > Helm Instance from the left navigation bar.
- On the Helm Instance page, select the target instance deployed using the cce-ingress-nginx-controller template, then click Update Operation.
- Add the following parameters on the update page to disable the Admission Webhook function.
1controller:
2admissionWebhooks:
3 enabled: false //false means disabled, true means enabledThe v4.11.5 of CCE Ingress Nginx Controller fixed related vulnerabilities. For more information, refer to CCE Ingress NGINX Controller Description. Please upgrade the component to v4.11.5 or higher during off-peak hours. If an upgrade is required, please submit a ticket.
Notes:
Once the upgrade is completed, re-enable the Admission Webhook function. This feature pre-validates ingress configurations to enhance service reliability and stability. Prior to applying ingress configuration changes, the Admission Webhook can promptly identify errors, helping you avoid unnecessary issues.