ID:11629 - Exploit for Permissions, Privileges, and Access Controls in Ingress-NGINX Controller for Kubernetes - CVE-2025-24514

Link to public exploit:

Vulnerability description

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to an error where the "auth-url" Ingress annotation can be used to inject configuration into nginx. A remote authenticated user can execute arbitrary code in the context of the ingress-nginx controller.

Remediation