Description
Ingress-NGINXController是Kubernetes生态的核心项目之一，作为集群流量入口网关，实现Ingress资源定义的流量路由规则，通过NGINX实现反向代理和负载均衡功能。Kubernetes Ingress-NGINXController 存在未授权远程代码执行漏洞（CVE-2025-1974）,攻击者可以通过该漏洞获取服务器敏感信息，执行恶意命令，控制整个服务器。
Kubernetes Ingress-NGINX Controller 存在未授权远程代码执行漏洞（CVE-2025-1974）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://kubernetes.io/zh-cn/blog/2025/03/24/ingress-nginx-cve-2025-1974/
https://zhuanlan.zhihu.com/p/1892607345302950581
https://www.anquanke.com/post/id/305447
https://cloud.tencent.com/developer/article/2624378
https://support.huaweicloud.com/intl/zh-cn/bulletin-cce/CVE-2025-1974.html
https://wlaq.dlut.edu.cn/info/1095/6724.htm
https://g7shot.com/posts/k8s/ingressnightmare-cve-2025-1974/
https://nvd.nist.gov/vuln/detail/CVE-2025-1974
https://github.com/kubernetes/kubernetes/issues/131009