Security News > 2025 > March > Critical Ingress NGINX Controller Vulnerability Allows RCE Without Authentication
2025-03-24 18:55
A set of five critical security shortcomings have been disclosed in the Ingress NGINX Controller for Kubernetes that could result in unauthenticated remote code execution, putting over 6,500 clusters at immediate risk by exposing the component to the public internet. The vulnerabilities (CVE-2025-24513, CVE-2025-24514, CVE-2025-1097, CVE-2025-1098, and CVE-2025-1974 ), assigned a CVSS score of
News URL
https://thehackernews.com/2025/03/critical-ingress-nginx-controller.html
#authentication #critical #nginx #RCE #vulnerability #CVE-2025-1097 #CVE-2025-24513 #CVE-2025-24514 #CVE-2025-1974 #CVE-2025-1098
Related news
- Critical PHP RCE vulnerability mass exploited in new attacks (source)
- Critical Veeam Backup & Replication RCE vulnerability fixed, patch ASAP! (CVE-2025-23120) (source)
- Infoseccers criticize Veeam over critical RCE vulnerability and a failing blacklist (source)
- Gladinet’s Triofox and CentreStack Under Active Exploitation via Critical RCE Vulnerability (source)
- Critical Commvault RCE vulnerability fixed, PoC available (CVE-2025-34028) (source)
- GitLab patches critical authentication bypass vulnerabilities (source)
- Critical RCE flaw in Apache Tomcat actively exploited in attacks (source)
- New Critical AMI BMC Vulnerability Enables Remote Server Takeover and Bricking (source)
- IBM scores perfect 10 ... vulnerability in mission-critical OS AIX (source)
- Critical Next.js Vulnerability Allows Attackers to Bypass Middleware Authorization Checks (source)