Which products and versions are affected by CVE-2025-1097?

Affected: ingress-nginx-controller-1.11 (chainguard); ingress-nginx-controller-1.12 (chainguard); ingress-nginx-controller-1.13 (chainguard), among others. The full list is in the CVE brief.

Is CVE-2025-1097 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2025-1097 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2025-1097?

Public exploit code is available.

How urgently should CVE-2025-1097 be patched?

Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Request A Demo

WatchlistHigh

CVE-2025-1097ingress-nginx Vulnerability

ngress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation

Published Mar 25, 2025 · Updated Sep 10, 2026 · Also known as GHSA-823x-fv5p-h7hw, GO-2025-3565

Key Facts

Patch immediately

CVE-2025-1097 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting ingress-nginx-controller-1.11 (chainguard), ingress-nginx-controller-1.12 (chainguard), ingress-nginx-controller-1.13 (chainguard) and 8 more products.
It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
EPSS estimates a 33% probability of exploitation in the next 30 days.
Fixed versions are available, including govulncheck-vulndb 0.0.20250327T184518-1.1, ingress-nginx-controller-1.11 1.11.5-r0, ingress-nginx-controller-1.12 1.12.1-r14.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Scores

CVSS v3.1

8.8

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

33%

Higher than 98.3% of all scored CVEs

Exploit maturity

Proof of concept

ATLAS score

41/100

Publication score, see How it works

Exploitation Verdict

KEV listed

Not listed

Federal due date

None

No federal due date

Ransomware use

Not reported

Attributed actors

None named

Exploit & Defence Guidance

Exploit maturity

Proof of concept

Public exploit code

Proof-of-concept links

In-the-wild evidence

Reports of active use

Advisories And Exploit References

advisoryhttps://www.cve.org/CVERecord?id=CVE-2025-1097
advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2025-1097
advisoryGHSA advisory

Description

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the auth-tls-match-cn Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

Affected Products

14 affected entries in total

Product	Affected versions	Fixed in
ingress-nginx-controller-1.11chainguard	See advisory	1.11.5-r0
ingress-nginx-controller-1.12chainguard	See advisory	1.12.1-r14
ingress-nginx-controller-1.13chainguard	See advisory	1.13.9-r14
ingress-nginx-controller-1.14chainguard	See advisory	1.14.5-r27
ingress-nginx-controller-fips-1.11chainguard	See advisory	1.11.5-r0

6 more affected products in the full CVE brief

Patched Releases

govulncheck-vulndb

0.0.20250327T184518-1.1

ingress-nginx-controller-1.11

1.11.5-r0

ingress-nginx-controller-1.12

1.12.1-r14

ingress-nginx-controller-1.13

1.13.9-r14

ingress-nginx-controller-1.14

1.14.5-r16, 1.14.5-r27

ingress-nginx-controller-fips-1.11

1.11.5-r0

ingress-nginx-controller-fips-1.12

1.12.1-r0

ingress-nginx-controller-fips-1.13

1.13.9-r12

ingress-nginx-controller-fips-1.14

1.14.5-r12

k8s.io/ingress-nginx

1.11.5, 1.12.1

Timeline

Publicly disclosed
Mar 25, 2025
Last updated
Sep 10, 2026

Weakness Type

CWE-15 External Control of System or Configuration Setting
CWE-20 Improper Input Validation

References

6 more references in the full CVE brief

FAQ

Common Questions.

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the auth-tls-match-cn Ingress annotation can be used to inject configuration into nginx.
Affected: ingress-nginx-controller-1.11 (chainguard); ingress-nginx-controller-1.12 (chainguard); ingress-nginx-controller-1.13 (chainguard), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including govulncheck-vulndb 0.0.20250327T184518-1.1, ingress-nginx-controller-1.11 1.11.5-r0, ingress-nginx-controller-1.12 1.12.1-r14.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Is CVE-2025-1097 On Your Attack Surface?

Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.