PT-2025-12713 · Unknown+1 · Ingress-Nginx+1

Nir Ohfeld + 2 · Published 2025-03-23 · Updated 2026-05-04 · CVE-2025-1097

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ingress-nginx versions prior to 1.11.5 ingress-nginx versions 1.12.0-beta.0 through 1.12.0

Description A security issue exists where the auth-tls-match-cn Ingress annotation can be used to inject configuration into nginx. This may allow a remote attacker to execute arbitrary code within the context of the ingress-nginx controller and disclose Secrets accessible to the controller. In default installations, the controller typically has access to all Secrets cluster-wide.

Recommendations Update to version 1.11.5 or later. Update to version 1.12.1 or later. As a temporary workaround, restrict or avoid using the auth-tls-match-cn annotation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-15

CWE-20

Related Identifiers

BDU:2025-05140

BIT-NGINX-INGRESS-CONTROLLER-2025-1097

CVE-2025-1097

GHSA-823X-FV5P-H7HW

GO-2025-3565

OPENSUSE-SU-2025:14937-1

Affected Products

Red Os

Ingress-Nginx

References · 133

• 🔥 https://exploit-db.com/exploits/52475 · Exploit
• https://osv.dev/vulnerability/GHSA-823x-fv5p-h7hw · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3565 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-1097 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/719085 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:14937-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-nginx-ingress-controller-2025-1097 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1097 · Security Note
• https://bdu.fstec.ru/vul/2025-05140 · Security Note
• https://github.com/kubernetes/kubernetes/issues/131007 · Note
• https://github.com/kubernetes/ingress-nginx · Note
• https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.11.5 · Note
• https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.12.1 · Note
• https://twitter.com/d0tslash/status/1904903170528026914 · Twitter Post