---
id: 7042
title: "[CVE-2025-1097] IngressNightmare: CVE-2025-1974 - 9.8 Critical Unauthenticated Remote Code Execution Vulnerabilities in Ingress NGINX"
cve: CVE-2025-1097
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities"
published_at: "2025-03-24T21:45:26Z"
tags: ["cloud", "rce", "cloud-security", "kubernetes", "vulnerability", "ingress-nginx", "cve-2025-1974"]
phying_url: "https://phying.com/item/7042"
lang: en
---

# [CVE-2025-1097] IngressNightmare: CVE-2025-1974 - 9.8 Critical Unauthenticated Remote Code Execution Vulnerabilities in Ingress NGINX

## Summary

Wiz Research discovered IngressNightmare: four unauthenticated RCE flaws in Kubernetes Ingress NGINX (CVE-2025-1974 et al., CVSS 9.8) exposing all cluster secrets; ~43% of cloud environments affected.

## Intelligence Metadata

- **Sources:** wiz.io
- **CVE:** CVE-2025-1097
- **Published:** 2025-03-24T21:45:26Z
- **Original:** https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities
- **Phying News:** https://phying.com/item/7042