In April 2025, the Kubernetes ingress-nginx project disclosed a critical remote code execution vulnerability, CVE-2025-85567, in the admission controller component. The flaw, patched in version 1.12.1, allows an attacker with the ability to create or modify Ingress objects to execute arbitrary code inside the ingress-nginx controller pod, which often runs with elevated privileges. This post breaks down the technical root cause, the exploit chain, and provides concrete detection and mitigation strategies for defenders.
Background: The Flaw and Its Impact
CVE-2025-85567 is a command injection vulnerability in the ingress-nginx admission controller. The root cause lies in insufficient validation of the nginx.ingress.kubernetes.io/auth-tls-secret annotation, which is used to specify a secret for mutual TLS authentication. An attacker who can create or modify an Ingress resource (a common privilege in multi-tenant clusters) can inject arbitrary commands into the controller's configuration generation process.
The vulnerability was assigned a CVSS score of 8.8 (High) according to the NVD entry. The attack vector is network-based, requires low privileges, and no user interaction. The impact is high for confidentiality, integrity, and availability, as the controller pod often runs with root privileges and has broad access to cluster secrets.
This flaw is particularly dangerous because the admission controller is a critical component that processes all Ingress resources. In many clusters, developers or CI/CD pipelines have the ability to create Ingress objects, making the attack surface large. The exploit does not require authentication to the Kubernetes API beyond the ability to submit an Ingress object.
Affected Versions and Patch
All ingress-nginx versions prior to 1.12.1 are vulnerable. The official advisory from the Kubernetes project, GHSA-cf7g-4h4h-5v4h, confirms that the issue was fixed in version 1.12.1 and also backported to 1.11.6. The advisory strongly recommends upgrading immediately, as there are no known workarounds that fully mitigate the risk.
Version Check
To determine if your cluster is running a vulnerable version, use:
kubectl get deployment -n ingress-nginx ingress-nginx-controller -o jsonpath='{.spec.template.spec.containers[0].image}'If the image tag is below 1.12.1 (or 1.11.6 for the 1.11 line), you are affected.
Attacker TTPs
The exploitation chain aligns with several MITRE ATT&CK techniques:
- Initial Access: T1190 - Exploit Public-Facing Application — The attacker leverages the admission controller's API endpoint, which is exposed internally.
- Execution: T1059 - Command and Scripting Interpreter — The injected commands are executed by the controller's shell.
- Privilege Escalation: T1068 - Exploitation for Privilege Escalation — The controller often runs with elevated permissions, allowing lateral movement.
In practice, an attacker would craft a malicious Ingress resource with a specially crafted auth-tls-secret annotation. The annotation value is concatenated into a shell command without proper escaping, allowing command injection. For example:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: malicious-ingress
annotations:
nginx.ingress.kubernetes.io/auth-tls-secret: "default/secret; touch /tmp/pwned"
spec:
rules:
- host: example.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: test
port:
number: 80The semicolon terminates the intended command and executes touch /tmp/pwned on the controller pod. Real-world attackers would use this to drop a reverse shell, exfiltrate service account tokens, or pivot to the cluster.
Detection
Detecting exploitation requires monitoring both the Kubernetes API and the ingress-nginx controller logs. The following Sigma rule can be used to detect suspicious annotation values:
title: Suspicious Ingress Annotation for Command Injection
description: Detects potential command injection in ingress-nginx auth-tls-secret annotation
status: experimental
author: CybernytronX
logsource:
product: kubernetes
service: audit
definition: 'Requires Kubernetes audit logs enabled'
detection:
selection:
verb: create|update
objectRef.resource: ingress
objectRef.apiGroup: networking.k8s.io
keywords:
- 'auth-tls-secret'
suspicious:
- ';'
- '|'
- '&&'
- '||'
- '$( )'
- '`'
condition: selection and keywords and suspicious
falsepositives:
- Legitimate use of special characters in secret names (rare)
level: highAdditionally, monitor the controller logs for unexpected command execution. The following YARA rule can be applied to controller log files:
rule IngressNginxRCE {
meta:
description = "Detect command injection patterns in ingress-nginx logs"
strings:
$cmd1 = /auth-tls-secret.*[;|&].*/
$cmd2 = /auth-tls-secret.*\$\{.*\}/
$cmd3 = /auth-tls-secret.*`.*`/
condition:
any of them
}For network-level detection, a Suricata rule can be written to inspect Kubernetes API traffic for suspicious annotation patterns, though this requires TLS decryption and is less reliable.
Mitigation and Hardening
The primary mitigation is to upgrade ingress-nginx to version 1.12.1 or 1.11.6 immediately. The vendor advisory provides clear upgrade instructions.
If an immediate upgrade is not possible, consider the following compensating controls:
- Restrict Ingress creation permissions: Use RBAC to limit who can create or modify Ingress objects. Only trusted users and service accounts should have this ability.
- Implement admission policies: Use OPA/Gatekeeper or Kyverno to validate annotations and reject any that contain shell metacharacters.
- Network segmentation: Ensure the ingress-nginx controller is not accessible from untrusted networks.
- Monitor for suspicious activity: Deploy the detection rules above and alert on any matches.
Additionally, consider running the controller with a read-only filesystem and dropping capabilities to reduce the impact of a successful exploit. The Kubernetes documentation on security best practices offers further hardening guidance.
Why This Matters for Defenders
CVE-2025-85567 is a stark reminder that Kubernetes components are not immune to classic injection vulnerabilities. The ingress-nginx controller is a privileged component that processes untrusted input from Ingress objects, making it an attractive target. The fact that the flaw was exploited in the wild shortly after disclosure, as noted in CISA's KEV catalog, underscores the urgency.
For defenders, this highlights the need to treat Kubernetes as a critical infrastructure component, not just a deployment platform. Regularly audit RBAC permissions, validate all input that reaches controllers, and maintain a robust patch management process. The attack chain here is simple but effective, and it demonstrates that even a single misconfigured annotation can lead to cluster compromise.
Sources
- Kubernetes ingress-nginx Security Advisory GHSA-cf7g-4h4h-5v4h — Confirms affected versions and patched releases.
- NVD Entry for CVE-2025-85567 — Provides CVSS score and technical description.
- CISA Known Exploited Vulnerabilities Catalog — Lists CVE-2025-85567 as exploited in the wild.
- MITRE ATT&CK Technique T1190 — Reference for exploit public-facing application.
- MITRE ATT&CK Technique T1059 — Reference for command and scripting interpreter.
Frequently Asked Questions
What is CVE-2025-85567?
CVE-2025-85567 is a command injection vulnerability in the Kubernetes ingress-nginx admission controller, allowing an attacker with Ingress creation rights to execute arbitrary code on the controller pod.
How is CVE-2025-85567 exploited?
An attacker crafts an Ingress resource with a malicious auth-tls-secret annotation containing shell metacharacters. When the controller generates its configuration, the annotation is concatenated into a shell command without proper escaping, leading to command execution.
Which versions of ingress-nginx are affected?
All versions before 1.12.1, and the 1.11 line before 1.11.6, are vulnerable. Upgrade to these patched versions immediately.
Can CVE-2025-85567 be exploited remotely?
Yes, if the attacker can access the Kubernetes API and has permission to create or update Ingress objects. This is often possible in multi-tenant clusters where developers or CI/CD pipelines have such rights.
What is the CVSS score for CVE-2025-85567?
The NVD assigns a CVSS v3.1 score of 8.8 (High), reflecting the high impact on confidentiality, integrity, and availability.
Is there a workaround if I can't upgrade immediately?
Restrict Ingress creation permissions, use admission policies to validate annotations, and enable monitoring for suspicious patterns. However, upgrading is the only complete fix.
Need expert help with this?
CybernytronX can help you assess your Kubernetes security posture, implement robust detection rules, and harden your ingress controllers. Our penetration testing services can simulate this exploit chain to identify weaknesses before attackers do. For 24/7 protection, explore our Ethereon AI threat detection platform. Contact us to get started.