CVE-2025-1974 PoC — ingress-nginx admission controller RCE escalation

Source

https://github.com/rjhaikal/POC-IngressNightmare-CVE-2025-1974

Associated Vulnerability

Title: ingress-nginx admission controller RCE escalation (CVE-2025-1974)
Description:A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

Description

POC IngressNightmare (CVE-2025-1974), modified from https://github.com/yoshino-s/CVE-2025-1974

Readme

# POC of IngressNightmare (CVE-2025-1974)

>Developed from:
- https://github.com/yoshino-s/CVE-2025-1974
- https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities

Talk is cheap, just look at the code.

Detailed can be found at https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities

## Usage

1. Change the ip in `shell.c`
2. Check the docker is available and run `make shell.so`. (We need to build so in alpine to make sure it can works in nginx-ingress-controller which is base on musl-libc)
3. Run `python3 exploit.py` to get your shell.

> You may need to change the range at line 25 and 26, which indicates the range of the pid and fd. The default value is a compromise between the speed and the success rate.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →