CVE-2025-1097: 
Ingress NGINX Controller (community-driven) vulnerability analysis and mitigation

A critical security vulnerability (CVE-2025-1097) was discovered in ingress-nginx, affecting the auth-tls-match-cn Ingress annotation functionality. The vulnerability was discovered in March 2025 and affects ingress-nginx versions prior to v1.11.5 and v1.12.1. This security issue allows attackers to inject configuration into nginx through the Ingress annotation, potentially leading to arbitrary code execution and unauthorized access to cluster-wide secrets (Kubernetes Issue, Wiz Blog).

The vulnerability exists in the ingress-nginx controller's handling of the auth-tls-match-cn Ingress annotation, where insufficient input sanitization allows for NGINX configuration injection. The issue has been assigned a CVSS v3.1 base score of 8.8 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability specifically affects the admission controller component which processes incoming ingress objects and validates NGINX configurations (Kubernetes Issue, Wiz Blog).

The exploitation of this vulnerability can lead to arbitrary code execution in the context of the ingress-nginx controller. This gives attackers access to all Secrets across all namespaces in the Kubernetes cluster, as the controller typically has cluster-wide secret access permissions in default installations. According to research, approximately 43% of cloud environments are vulnerable to this issue, including systems belonging to Fortune 500 companies (Wiz Blog).

Organizations should immediately upgrade their ingress-nginx installations to version 1.11.5, 1.12.1, or later to address this vulnerability. If immediate upgrading is not possible, administrators can implement temporary mitigations by enforcing strict network policies to limit access to the admission controller endpoint or by temporarily disabling the admission controller component. The presence of suspicious data within the auth-tls-match-cn annotation of an Ingress resource may indicate exploitation attempts (Kubernetes Issue).

The vulnerability was discovered and reported by security researchers from Wiz (Nir Ohfeld, Ronen Shustin, Sagi Tzadik, and Hillai Ben Sasson). The Kubernetes security team, particularly Marco Ebert, James Strong, Tabitha Sable, and the Kubernetes Security Response Committee, coordinated the fix and response to this security issue (Kubernetes Issue).