CVE-2025-24514
ingress-nginx controller - configuration injection via unsanitized auth-url annotation
Reported by kubernetes · Published March 24, 2025
k8s.io/ingress-nginx is fixed in 1.12.1 and 1.11.5 (Go Modules)
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| k8s.io/ingress-nginx | Go Modules | 1.12.1, 1.11.5 |
| ingress-nginx-controller-1.14 | Chainguard | 1.14.5-r27, 1.14.5-r16 |
| ingress-nginx-controller-1.12 | Wolfi | 1.12.1-r14 |
| ingress-nginx-controller-1.11 | Chainguard | 1.11.5-r0 |
| ingress-nginx-controller-fips-1.12 | Chainguard | 1.12.1-r0 |
| ingress-nginx | kubernetes | 1.11.4 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| kubernetes | ingress-nginx | 0, 1.12.0 |
| chainguard | ingress-nginx-controller-1.14 | 0, 0 |
| wolfi | ingress-nginx-controller-1.12 | 0 |
| chainguard | ingress-nginx-controller-1.15 | * |
| chainguard | ingress-nginx-controller-1.11 | 0 |
| chainguard | ingress-nginx-controller-fips-1.12 | 0 |
| chainguard | ingress-nginx-controller-fips-1.10 | * |
| kubernetes | ingress-nginx | 1.12.0, 0 |
| chainguard | ingress-nginx-controller-fips-1.14 | 0 |
| chainguard | ingress-nginx-controller-fips-1.13 | 0 |
| wolfi | ingress-nginx-controller-1.11 | 0 |
| wolfi | ingress-nginx-controller-1.10 | * |
| chainguard | ingress-nginx-controller-1.13 | 0 |
| wolfi | ingress-nginx-controller-1.15 | * |
| chainguard | ingress-nginx-controller-fips-1.11 | 0 |
| chainguard | ingress-nginx-controller-fips-1.15 | * |
| k8s.io | ingress-nginx | 0, 1.12.0-beta.0 |
| chainguard | ingress-nginx-controller-1.12 | 0 |
| wolfi | ingress-nginx-controller-1.14 | 0, 0 |
| chainguard | ingress-nginx-controller-1.10 | * |
Timeline
- Mar 24, 2025 CVE Published
- Mar 25, 2025 PoC Published (2 in total, the first dated here)
- Mar 25, 2025 EPSS Score (30 in total, the first dated here)
- Mar 25, 2025 Coalition ESS Score (29 in total, the first dated here)
- Feb 26, 2026 CVE Updated
- Mar 17, 2026 Security Advisory (16 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-24514
vulnetix vdb fixes CVE-2025-24514Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-24514/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://security.netapp.com/advisory/ntap-20250328-0008/ url
- https://www.exploit-db.com/exploits/52475 url
- https://nvd.nist.gov/vuln/detail/CVE-2025-24514 advisory
- https://github.com/advisories/GHSA-fwwp-xcxw-39vq advisory
- https://github.com/kubernetes/ingress-nginx url
- https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.11.5 url
- https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.12.1 url
- https://groups.google.com/g/kubernetes-security-announce/c/2qa9DFtN0cQ url
- https://security.netapp.com/advisory/ntap-20250328-0008 advisory