THE BASE COLLECTIONCRDS / 0.1

CVE-2025-1974CRITICAL

IngressNightmare

initial accessT1190

An unauthenticated attacker with access to the pod network reaches arbitrary code execution in the ingress controller, which usually holds cluster-wide secrets.

CVSS

9.8

EPSS

100%

PATCH

Vendor

Upgrade the ingress controller to a fixed release, and restrict which workloads can reach its admission endpoint.

SCRTY:CRDS / BASE SETREV. 01 ◆

Raw JSON

One vulnerability. The facts that matter.
A clear next move.

criticalREV. 01

CVE-2025-1974IngressNightmare — Code Execution From the Kubernetes Pod Network

An unauthenticated attacker with access to the pod network reaches arbitrary code execution in the ingress controller, which usually holds cluster-wide secrets.

YOUR NEXT MOVE

Upgrade the ingress controller to a fixed release, and restrict which workloads can reach its admission endpoint.

Read the risk

THE VITAL STATS

CVSS score: 9.8/ 10
EPSS probability: 100%
Attack complexity: Low
Known exploited: Not listed
CVE published: 2025-03-25
Exploit published: Not recorded
Confidence: medium
Kill chain: initial access
MITRE ATT&CK: T1190
Severity: critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attacker needsAccess to the pod network

Behind the card

1 REFERENCES

01CVE recordNVD recordnvd.nist.gov

Field-level provenanceTRACE THE SOURCES +

Which source supports each field, when it was retrieved, and who extracted it.

Fields	Source	Retrieved	Extractor	Confidence
cvss, exploitation.attack_complexity, exploitation.exploit_available, references, published_at	nvd.nist.gov	2026-08-07	scrty-crds-pipeline/0.1	high
epss	api.first.org	2026-08-07	scrty-crds-pipeline/0.1	high
title, summary, severity, remediation, mitre_attack, kill_chain, recommended_action, confidence, tags, exploitation.prerequisites	nvd.nist.gov	2026-08-07	claude-code	high

Printing history

THE RECORD

r12026-09-20Initial base card

First printing. This card has not been reprinted since publication.