CVE-2025-1098: ingress-nginx controller - configuration injection via unsanitized mirror annotations
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the mirror-target and mirror-host Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Other sources
A security issue was discovered in ingress-nginx where the mirror-target and mirror-host Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
— GitHub
Ingress Controllers play a critical role within Kubernetes clusters by enabling the functionality of Ingress resources. Azure Kubernetes Service (AKS) is aware of several security vulnerabilities affecting the Kubernetes ingress-nginx controller, including CVE-2025-1098, CVE-2025-1974, CVE-2025-1097, CVE-2025-24514, and CVE-2025-24513. Customers running this controller on their AKS clusters are advised to update to the latest patched versions (v1.11.5 and v1.12.1) to mitigate potential risks.
— Microsoft
Kubernetes: Vulnerability in Kubernetes NGINX Ingress Controller
— Microsoft
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-1098?
CVE-2025-1098 has been classified with a high severity level due to its potential impact on Kubernetes cluster security.
How do I fix CVE-2025-1098?
To remediate CVE-2025-1098, update the ingress-nginx controller to the latest version recommended by Microsoft.
What systems are affected by CVE-2025-1098?
CVE-2025-1098 affects Azure Kubernetes Service running the ingress-nginx controller.
What are the potential consequences of CVE-2025-1098?
Exploitation of CVE-2025-1098 could lead to remote code execution within the Kubernetes cluster.
Is there a workaround for CVE-2025-1098?
While the best solution is to apply the updates, temporarily restricting ingress resources may serve as a workaround until a patch is implemented.