CVE-2025-1098
HighPublic exploitingress-nginx controller - configuration injection via unsanitized mirror annotations
Published Mar 25, 2025 · Updated Sep 10, 2026 · Also known as GHSA-vg63-w3p9-jc9m, GO-2025-3568
Key Facts
Patch immediately- CVE-2025-1098 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting ingress-nginx-controller-1.11 (chainguard), ingress-nginx-controller-1.12 (chainguard), ingress-nginx-controller-1.13 (chainguard) and 8 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 82% probability of exploitation in the next 30 days.
- Fixed versions are available, including govulncheck-vulndb 0.0.20250327T184518-1.1, ingress-nginx-controller-1.11 1.11.5-r0, ingress-nginx-controller-1.12 1.12.1-r14.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
82%
Higher than 99.6% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2025-1098 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the mirror-target and mirror-host Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Affected Products
14 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| ingress-nginx-controller-1.11chainguard | See advisory | 1.11.5-r0 |
| ingress-nginx-controller-1.12chainguard | See advisory | 1.12.1-r14 |
| ingress-nginx-controller-1.13chainguard | See advisory | 1.13.9-r14 |
| ingress-nginx-controller-1.14chainguard | See advisory | 1.14.5-r27 |
| ingress-nginx-controller-fips-1.11chainguard | See advisory | 1.11.5-r0 |
Patched Releases
govulncheck-vulndb
0.0.20250327T184518-1.1
ingress-nginx-controller-1.11
1.11.5-r0
ingress-nginx-controller-1.12
1.12.1-r14
ingress-nginx-controller-1.13
1.13.9-r14
ingress-nginx-controller-1.14
1.14.5-r16, 1.14.5-r27
ingress-nginx-controller-fips-1.11
1.11.5-r0
ingress-nginx-controller-fips-1.12
1.12.1-r0
ingress-nginx-controller-fips-1.13
1.13.9-r12
ingress-nginx-controller-fips-1.14
1.14.5-r12
k8s.io/ingress-nginx
1.11.5, 1.12.1
Timeline
Publicly disclosed
Mar 25, 2025
Last updated
Sep 10, 2026
Weakness Type
- CWE-15 External Control of System or Configuration Setting
- CWE-20 Improper Input Validation
References
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2025/1xxx/CVE-2025-1098.json
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2025-1098
- exploitExploitDB-52475
- articlehttps://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.11.5
FAQ
Common Questions.
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the mirror-target and mirror-host Ingress annotations can be used to inject arbitrary configuration into nginx.
Affected: ingress-nginx-controller-1.11 (chainguard); ingress-nginx-controller-1.12 (chainguard); ingress-nginx-controller-1.13 (chainguard), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including govulncheck-vulndb 0.0.20250327T184518-1.1, ingress-nginx-controller-1.11 1.11.5-r0, ingress-nginx-controller-1.12 1.12.1-r14.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2025-1098 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo