Alert Status: Critical
Kubernetes maintainers have published an advisory detailing multiple critical vulnerabilities in Ingress-NGINX Controller that could allow unauthenticated remote code execution and full cluster takeover.
The Department of Information and Communications Technology (DICT) through the National Cyber Security Center (NCSC) issues this advisory to alert all PNG Government departments, agencies, and organizations about critical vulnerabilities discovered in Ingress-NGINX Controller for Kubernetes.
Background
The identified vulnerabilities are categorized under the Common Vulnerabilities and Exposures (CVE) system with the following reference numbers:
– CVE-2025-1097
– CVE-2025-1098
– CVE-2025-1974
– CVE-2025-24513
– CVE-2025-24514
If successfully exploited, these vulnerabilities could allow attackers to execute arbitrary code, access all cluster secrets across namespaces, and potentially lead to complete cluster takeover. These vulnerabilities pose significant risks as they could compromise the confidentiality, integrity, and availability of affected systems.
Affected Versions or applications
| Product | Version | Solution |
| NGINX Controller | 1.12.1 | Upgrade to latest version |
| NGINX Controller | 1.11.5 | Upgrade to latest version |
Mitigation
To safeguard your organization’s systems and data, DICT and NCSC strongly recommend taking the following actions:
1. Review Systems: Conduct a comprehensive review of your Kubernetes clusters to identify any instances of Ingress-NGINX Controller running vulnerable versions.
2. Upgrade affected versions of NGINX Controller
3. Secure Admission Webhook: Ensure the admission webhook endpoint is not exposed externally to prevent unauthorized access.
For detailed instructions and additional guidance, refer to the official Kubernetes maintainer’s advisory through the following link:
Kubernetes – Ingress-NGINX Releases –
For further information about these vulnerabilities, visit:
Remote Code Execution Vulnerabilities in Ingress NGINX | Wiz Blog
Prompt action is crucial to mitigate these critical vulnerabilities and ensure the security of your Kubernetes clusters. By remaining vigilant and keeping your systems up-to-date, you can effectively protect against potential cyber threats.
For more alerts and advisories, visit the DICT website or follow our official communications channels. Organizations or individuals requiring assistance or further information can contact the National Cyber Security Center (NCSC). Together, let us prioritize cybersecurity and protect Papua New Guinea’s digital landscape.