CVE-2025-1974: Securing Your Kubernetes Ingress Controller

A newly discovered vulnerability (CVE-2025-1974) in Kubernetes Ingress Controllers has sent shockwaves through the cloud-native community. This critical security flaw affects multiple implementations including NGINX, Traefik, and Azure Kubernetes Service (AKS) ingress controllers, potentially allowing attackers to execute remote code or intercept sensitive traffic.

Understanding the Vulnerability

CVE-2025-1974 is a path traversal vulnerability that affects how Ingress Controllers process specially crafted HTTP requests. Security researchers at Aqua Security discovered that:

  • Malicious actors can bypass path sanitization
  • Unauthorized access to backend services is possible
  • Privilege escalation may occur in certain configurations

The vulnerability scores 9.8 (Critical) on the CVSS v3.1 scale due to its:
1. Low attack complexity
2. No privilege requirements
3. High impact on confidentiality, integrity, and availability

Affected Versions

The vulnerability impacts these common Ingress Controller implementations:

  • NGINX Ingress Controller: Versions 1.2.0 through 1.5.3
  • Traefik: Versions 2.6.0 to 2.9.4
  • Azure Kubernetes Service (AKS): All deployments using default ingress before March 2025
  • HAProxy Ingress: Versions 0.13.0 to 0.14.0

Attack Vectors and Potential Impact

Attackers can exploit this vulnerability through:

GET /../../../../etc/passwd HTTP/1.1
Host: vulnerable-app.com

Successful exploitation could lead to:

  • Sensitive file disclosure from backend pods
  • Unauthorized API server access
  • Cluster-wide compromise in certain configurations
  • Data exfiltration from connected storage systems

Mitigation Strategies

Immediate Actions

  1. Patch Immediately: All major vendors have released updates:
    - NGINX: Upgrade to 1.5.4+
    - Traefik: Upgrade to 2.9.5+
    - AKS: Apply March 2025 security update

  2. Network Controls:
    - Implement WAF rules to block path traversal patterns
    - Restrict ingress traffic to known-good IP ranges

  3. Runtime Protection:
    - Enable pod security policies
    - Deploy runtime anomaly detection

Long-Term Security Improvements

  • Zero Trust Architecture: Implement service mesh with mTLS
  • Regular Audits: Schedule quarterly ingress configuration reviews
  • Minimal Permissions: Follow principle of least privilege for ingress resources

Azure Kubernetes Service Specific Guidance

Microsoft has released special guidance for AKS users:

az aks update --resource-group myResourceGroup --name myAKSCluster --kubernetes-version 1.28.5

Key AKS-specific recommendations:

  • Enable Azure Defender for Kubernetes
  • Review Application Gateway Ingress Controller (AGIC) configurations
  • Audit all Ingress resources using kubectl get ingress --all-namespaces

Detection Methods

To check if your cluster has been compromised:

kubectl logs -n ingress-nginx -l app.kubernetes.io/name=ingress-nginx --tail=100 | grep "/.."

Look for these indicators of compromise:

  • Unexpected 200 responses to requests with .. patterns
  • Newly created pods in kube-system namespace
  • Unauthorized configmap changes

Lessons for Kubernetes Security

This incident highlights several important security considerations:

  1. Ingress is a Critical Attack Surface: Often overlooked in security assessments
  2. Default Configurations Aren't Secure: Always review and harden ingress settings
  3. Vulnerability Management is Essential: Establish processes for rapid patch application

Timeline and Vendor Responses

  • 2025-01-15: Vulnerability discovered by Aqua Security
  • 2025-02-01: Coordinated disclosure to CNCF and major vendors
  • 2025-03-10: Patches released by all major vendors
  • 2025-03-15: Public disclosure (CVE-2025-1974 assigned)

Additional Resources

For ongoing updates, monitor these sources:

  • Kubernetes Security Announcements mailing list
  • Azure Security Center notifications
  • CNCF Security TAG bulletins
# Example secure ingress configuration
autoscaling:
  enabled: true
  minReplicas: 2
  maxReplicas: 10
securityContext:
  readOnlyRootFilesystem: true
  runAsNonRoot: true

Stay vigilant and ensure all Kubernetes clusters receive this critical update immediately to prevent potential breaches.