tag
Kubernetes
IngressNightmare: Kubernetes ingress-nginx Admission Controller Shared-Library Injection RCE (CVE-2025-1974)
The ingress-nginx admission controller validates incoming Ingress objects by rendering a temporary NGINX configuration and running nginx -t against it — but the validation webhook itself has no authentication and accepts attacker-controlled configuration…
OS Command Injection in KubeAI via Model URL (CVE-2026-34940)
KubeAI constructs a Kubernetes startup probe shell script by interpolating Model CRD URL components (ref, modelParam) into a bash -c command via Go's fmt.Sprintf. Shell metacharacters in these fields are not sanitized, so any user holding only Model CRD…
Kubernetes `runAsNonRoot` Bypass via UID Integer Overflow (CVE-2026-46680)
Kubernetes' securityContext.runAsNonRoot: true admission check is meant to prevent Pods from running as UID 0 (root). This PoC demonstrates that a crafted container image with a numeric UID value that overflows the integer type used internally by the…
Apache Flink Kubernetes Operator SSRF via jarURI (CVE-2026-40564)
The Apache Flink Kubernetes Operator reconciles FlinkSessionJob (and FlinkDeployment) custom resources by fetching the JAR referenced in spec.job.jarURI from inside its own pod, without validating the URI's scheme, host, or resolved IP address. Any user…
IngressNightmare - Kubernetes Ingress-NGINX Unauthenticated RCE
IngressNightmare is a chain of critical vulnerabilities (CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, CVE-2025-1974) in the Kubernetes Ingress-NGINX admission controller. Discovered by Wiz Research, the vulnerabilities allow an unauthenticated attacker…