CVE-2025-1974: Remote Code Execution in ingress-nginx

CVE-2025-1974 is an arbitrary code execution (RCE) vulnerability in the Kubernetes ingress-nginx controller. An unauthenticated attacker with access to the pod network can exploit it to execute code in the controller context. The vulnerability is particularly critical because the default installation allows the controller to access all cluster-wide Secrets, creating a direct exfiltration vector toward sensitive platform data.

With CVSS 9.8, this vulnerability falls into the critical category according to standard scoring criteria. The official NVD description confirms the risk of Remote Code Execution and Secrets disclosure. A GitHub signal dated October 30, 2026 (today) reports the existence of public repositories claiming to contain exploits; however, official data does not provide information about patch availability or a confirmed remediation timeline.

If you operate Kubernetes clusters with ingress-nginx, immediately identify and inventory all your controllers in production. Monitor the official ingress-nginx repository for patch announcements or advisories. Reduce exposure by restricting pod network access from untrusted users and workloads through network policies. Prepare a timely upgrade procedure: as soon as a corrected version is officially released, evaluate controller replacement with high priority. Meanwhile, increase monitoring of controller logs to detect suspicious access and anomalous activity.