NGINX vulnerability: Quickly detect and mitigate IngressNightmare vulnerabilities with Dynatrace

On March 24, 2025, researchers revealed a series of critical vulnerabilities, collectively termed IngressNightmare, in the Ingress NGINX Controller for Kubernetes, with the most severe, CVE-2025-1974, scoring a 9.8 on the CVSS v3.1 scale. These vulnerabilities allow for unauthenticated remote code execution and unauthorized access to sensitive data across all namespaces within a Kubernetes cluster, potentially enabling a complete cluster takeover. The vulnerabilities affect publicly exposed deployments of the ingress-nginx controller versions up to v1.12.0 and below 1.11.5, and could impact 43% of cloud environments that utilize this widely used component for exposing Kubernetes applications externally. The exploitation involves a multi-step process that lets attackers upload files to the NGINX instance, manipulate the Content-Length header, and exploit command injection vulnerabilities, ultimately enabling arbitrary code execution and access to sensitive cluster data. Kubernetes has issued patches for versions 1.11.6 and 1.12.1 to address these vulnerabilities, and organizations are urged to upgrade to these versions or implement strict network access controls to mitigate risks. Monitoring tools like Dynatrace can be instrumental in identifying affected instances and detecting potential signs of exploitation, emphasizing the need for continuous vigilance and prompt upgrades in maintaining Kubernetes security.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.