CVE-2025-24513: ingress-nginx controller - auth secret file path traversal vulnerability
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.
Other sources
A security issue was discovered in ingress-nginx where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.
— GitHub
Ingress Controllers play a critical role within Kubernetes clusters by enabling the functionality of Ingress resources. Azure Kubernetes Service (AKS) is aware of several security vulnerabilities affecting the Kubernetes ingress-nginx controller, including CVE-2025-1098, CVE-2025-1974, CVE-2025-1097, CVE-2025-24514, and CVE-2025-24513. Customers running this controller on their AKS clusters are advised to update to the latest patched versions (v1.11.5 and v1.12.1) to mitigate potential risks.
— Microsoft
Kubernetes: Vulnerability in Kubernetes NGINX Ingress Controller
— Microsoft
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-24513?
CVE-2025-24513 is classified as a high-severity vulnerability due to its potential impact on Kubernetes clusters.
How do I fix CVE-2025-24513?
To fix CVE-2025-24513, you should update the ingress-nginx controller to the latest stable version.
What versions are affected by CVE-2025-24513?
CVE-2025-24513 affects specific versions of the ingress-nginx controller running on Azure Kubernetes Service.
What is the impact of CVE-2025-24513?
The impact of CVE-2025-24513 could potentially allow an attacker to execute arbitrary code in a Kubernetes environment.
Is there a workaround for CVE-2025-24513?
A temporary workaround for CVE-2025-24513 includes enhancing network policies to restrict access to affected services.