String of defects in popular Kubernetes component puts 40% of cloud environments at risk

Security researchers disclosed five vulnerabilities in the widely used Ingress Nginx Controller for Kubernetes — including a critical unauthenticated RCE (CVE-2025-1974, CVSS 9.8) — that can be chained with configuration-injection flaws to allow cluster takeover and access to secrets. Patches have been released, but scans found thousands of potentially exposed controllers and public proof-of-concept exploits have appeared, creating a high risk for unpatched, publicly accessible clusters.