Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2025-1097] IngressNightmare: CVE-2025-1974 - 9.8 Critical Unauthenticated Remote Code Execution Vulnerabilities in Ingress NGINX

wiz.io | vulnerability | CVE-2025-1097 | #cloud | #rce | #cloud-security | #kubernetes | #vulnerability | #ingress-nginx | #cve-2025-1974

Summary

Wiz Research discovered IngressNightmare: four unauthenticated RCE flaws in Kubernetes Ingress NGINX (CVE-2025-1974 et al., CVSS 9.8) exposing all cluster secrets; ~43% of cloud environments affected.
Published
Collected

original ↗

Related coverage

  1. Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise (wiz.io)
  2. CVE-2022-22947: Spring Cloud Gateway Code Injection Vulnerability (blog.viettelcybersecurity.com)
  3. Wiz enhances real-time threat detection and response capabilities to stop threats from becoming incidents (wiz.io)
  4. Wiz Research Finds Critical NVIDIA AI Vulnerability Affecting Containers Using NVIDIA GPUs, Including Over 35% of Cloud Environments (wiz.io)
  5. CVE-2023-38545 high severity vulnerability in cURL: everything you need to know (wiz.io)
  6. Critical remote code execution in vm2, a widely used Node.js sandbox library (about.gitlab.com)

back