Forum Discussion
FAQ About IngressNightmare Vulnerabilities (CVE-2025-1974...
FAQ About IngressNightmare Vulnerabilities (CVE-2025-1974 and more)
On March 24, the Kubernetes team published a blog post and patches to address a series of vulnerabilities in the Ingress NGINX Controller for Kubernetes.
Collectively, these flaws are being referred to as IngressNightmare. Of the five vulnerabilities, CVE-2025-1974 is considered the most severe, as it was assigned a CVSSv3 score of 9.8 and the only critical flaw. However, the five flaws combined create a toxic combination (exploit chain) that could allow an attacker to access cluster secrets, which could lead to a cluster takeover.
For more information about these vulnerabilities, including the availability of patches and Tenable product coverage, please visit our FAQ blog.
No RepliesBe the first to reply
