IngressNightmare (CVE-2025-1974, CVE-2025-1097, CVE-2025-1098, CVE-2025-24513, CVE-2025-24514) in Kubernetes ingress-nginx: am I still exposed, and what do I do now that ingress-nginx is retired?

What it is: IngressNightmare is a set of five ingress-nginx controller flaws disclosed on March 24, 2025. The worst, CVE-2025-1974 (CVSS 9.8), let anyone who could reach the controller's validating admission webhook inject NGINX configuration and run code inside the controller pod. That pod can read Secrets across the cluster by default, so this could mean full cluster takeover. Researchers estimated that a large share of cloud environments ran ingress-nginx. Separately, the Kubernetes project retired ingress-nginx: best-effort maintenance ended in March 2026, so no further releases or security fixes are coming. Am I affected: - You run the community ingress-nginx controller (kubernetes/ingress-nginx; image registry.k8s.io/ingress-nginx/controller) before v1.11.5 or v1.12.1. The separate NGINX Inc. / F5 'NGINX Ingress Controller' is a different product. - Check: kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginx, then look at the controller image tag. Check whether the admission webhook service is reachable from pods or networks that shouldn't reach it. Fix: 1. Immediately: upgrade to v1.11.5, v1.12.1 or a later final release. 2. If you can't upgrade at once: disable the validating admission webhook (Helm: controller.admissionWebhooks.enabled=false, or delete the ValidatingWebhookConfiguration and remove the --validating-webhook flag), and restrict network access so only the Kubernetes API server can reach the webhook. Re-enable it after upgrading. 3. Plan a migration off ingress-nginx, because it no longer receives security fixes: move to Gateway API or another maintained ingress controller. After: look for unexpected Ingress objects or annotations, unusual processes or files in the controller pods, and use of the controller's service account token; if you suspect compromise, rotate cluster Secrets the controller could read. Sources: https://kubernetes.io/blog/2025/11/11/ingress-Nginx-retirement/ https://securitylabs.datadoghq.com/articles/kubernetes-ingress-nginx-retirement-warning/ https://docs.cloudera.com/data-engineering/cloud/release-notes/topics/cde-ingress-nginx-controller-vulnerabilities.html