Back to the CVE list
CVE-2025-1974

Kubernetes: Vulnerability in Kubernetes NGINX Ingress Controller

CVSS score

—

EPSS probability

%99.4

Risk score

—

Published

1 y ago

Public Exploits · GitHub and Metasploit Intelligence

This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.

zsxen/cve-2025-1974-lab

Public PoCSource updated: 07.04.2026 03:49:00

zsxen/CVE-2025-1974

Public PoCSource updated: 06.04.2026 13:43:08

ingress-nginx admission controller RCE escalation PoC

Public PoCSource updated: 20.01.2026 13:24:27

Kubernetes Ingress-nginx RCE (IngressNightmare)

Public PoCSource updated: 10.12.2025 09:28:36

iteride/CVE-2025-1974

Public PoCSource updated: 23.09.2025 17:41:17

BiiTts/POC-IngressNightmare-CVE-2025-1974

Public PoCSource updated: 10.08.2025 18:12:40

Armand2002/Exploit-CVE-2025-1974-Lab

Public PoCSource updated: 14.07.2025 13:46:28

abrewer251/CVE-2025-1974_IngressNightmare_PoC

Public PoCSource updated: 06.05.2025 23:57:40

IngressNightmare POC. world first non-blind remote execution exploitation with multi-advanced exploitation methods. allow on disk exploitation. CVE-2025-24514 - auth-url injection, CVE-2025-1097 - auth-tls-match-cn injection, CVE-2025-1098 – mirror UID injection -- all available.

Public PoCSource updated: 11.08.2026 08:35:07

IngressNightmare-POC CVE-2025-1974 https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities#how-did-we-discover-ingressnightmare-24 (★3)

Public PoCSource updated: 26.03.2025 19:01:00

Poc for Ingress RCE (★2)

Public PoCSource updated: 27.03.2025 01:46:57

Exploit for CVE-2025-1974 (★0)

Public PoCSource updated: 26.03.2025 17:30:27

PoC for CVE-2025-1974: Critical RCE in Ingress-NGINX (<v1.12.1) via unsafe config injection. Exploitable from the pod network without credentials, enabling code execution and potential cluster takeover. Fixed in v1.12.1 and v1.11.5. For research/education only. (★0)

Public PoCSource updated: 26.03.2025 20:50:52

Proof-of-Concept Tool to detect IngressNightmare (CVE-2025-1974) via (non-intrusive) active means. (★0)

Public PoCSource updated: 27.03.2025 00:55:41

PoC of CVE-2025-1974, modified from the world-first PoC~ (★0)

Public PoCSource updated: 27.03.2025 02:32:39

A minimal test tool to help detect annotation injection vulnerabilities in Kubernetes NGINX Ingress controllers. This script sends a crafted AdmissionReview request to simulate a potential exploit path from CVE-2025-1974 and checks for signs of misinterpreted annotations in controller logs. (★0)

Public PoCSource updated: 27.03.2025 12:31:50

POC IngressNightmare (CVE-2025-1974), modified from https://github.com/yoshino-s/CVE-2025-1974 (★0)

Public PoCSource updated: 29.03.2025 01:58:39

CVE-2025-1974 PoC 코드 (★0)

Public PoCSource updated: 31.03.2025 17:32:21

Exploit CVE-2025-1974 with a single file. (★0)

Public PoCSource updated: 10.04.2025 16:27:54

WHS3기 가상화 취약한(CVE) Docker 환경 구성 과제 (★0)

Public PoCSource updated: 27.04.2025 17:20:54

CVE-2025-1974 (★0)

Public PoCSource updated: 26.06.2025 18:53:22

Ingress-NGINX Admission Controller v1.11.1 - FD Injection to RCE

Exploit referenceSource updated: 04.02.2026 00:00:00

Ingress-NGINX 4.11.0 - Remote Code Execution (RCE)

Exploit referenceSource updated: 20.06.2025 00:00:00

Nuclei: Ingress-Nginx Controller - Remote Code Execution

Exploit reference

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2025-1974"