Kubernetes IngressNightmare Vulnerabilities: What You Need to Know

CrowdStrike details “IngressNightmare,” a set of ingress-nginx vulnerabilities (including CVE-2025-24514, CVE-2025-1097, CVE-2025-1098 and the critical CVE-2025-1974 with CVSS 9.8) that can be chained to allow arbitrary file upload/execution within ingress-nginx, potentially exposing cluster secrets and enabling lateral movement; the post identifies affected versions, recommends urgent patching or removing the ValidatingWebhook as a temporary mitigation, and describes Falcon SIEM dashboard visibility for detection and remediation tracking.