---
id: 9258
title: "IngressNightmare: Unauth RCE in Ingress NGINX (CVE-2025-1974)"
cve: CVE-2025-1974
source_domain: projectdiscovery.io
source_url: "https://projectdiscovery.io/blog/ingressnightmare-unauth-rce-in-ingress-nginx"
published_at: "2025-03-26T17:19:01Z"
tags: ["bug-bounty", "rce"]
phying_url: "https://phying.com/item/9258"
lang: en
---

# IngressNightmare: Unauth RCE in Ingress NGINX (CVE-2025-1974)

## Summary

A critical vulnerability (CVE-2025-1974) was recently discovered in the Kubernetes Ingress-NGINX Controller that allows unauthenticated remote code execution (RCE) on the ingress controller pod. Originally discovered by the Wiz research team (Nir Ohfeld, Ronen Shustin, Sagi Tzadik, Hillai Ben-Sasson) in late 2024 and disclosed in March 2025, CVE-2025-1974 is part of a series of vulnerabilities collectively called IngressNightmare. If you’re specifically looking to use the IngressNightmare dete

## Intelligence Metadata

- **Sources:** projectdiscovery.io
- **CVE:** CVE-2025-1974
- **Published:** 2025-03-26T17:19:01Z
- **Original:** https://projectdiscovery.io/blog/ingressnightmare-unauth-rce-in-ingress-nginx
- **Phying News:** https://phying.com/item/9258