> For the complete documentation index, see [llms.txt](https://platform9.com/kb/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://platform9.com/kb/smcp/frequently-asked-questions/ingress-nginx-vulnerability-cve-2025-1974.md).

# Ingress-Nginx Vulnerability (CVE-2025-1974)

## Problem

Critical Vulnerability CVE-2025-1974 impacting the Pod network has a good chance of taking over the Kubernetes cluster, with no credentials or administrative access required.

## Environment

* Self Managed Cloud Platform9 - 5.10. and 5.11.

## Solution

The fix for the issue is available in:

1. The SMCP-5.12 version, tracked in the Jira: AIR-1453.

## **Workaround**

#### **Section-1**

Below are the workaround steps to fix the vulnerability in Ingress Nginx deployment part of the SMCP versions 5.10. and 5.11:

1. From the master node verify the existing image version:

{% tabs %}
{% tab title="Management plane - Master node" %}

```javascript
$ sudo /opt/pf9/pf9-kube/bin/nerdctl -n k8s.io images | grep ingress

$ kubectl describe pod -n airctl-1-xxxxxxxx-xx-kplane   ingress-nginx-controller-xxxxxxxxxxx-xxxxx | grep -i image

$ kubectl describe pod -n airctl-1-xxxxxxxx-xx   ingress-nginx-controller-xxxxxxxxxxx-xxxxx | grep -i image
```

{% endtab %}
{% endtabs %}

2. Download `ingress-nginx_1.12.1.tgz` image having the patch:

{% tabs %}
{% tab title="Master node" %}

```javascript
$ docker pull registry.k8s.io/ingress-nginx/controller:v1.12.1
$ docker save registry.k8s.io/ingress-nginx/controller | gzip > ingress-nginx_1.12.1.tgz
```

{% endtab %}
{% endtabs %}

3. Copy and load image into the management node

{% tabs %}
{% tab title="Master node" %}

```javascript
$ ls ingress-nginx_1.12.1.tgz 

$ sudo /opt/pf9/pf9-kube/bin/nerdctl load --input ingress-nginx_1.12.1.tgz --namespace k8s.io
```

{% endtab %}
{% endtabs %}

4. Verify the `ingress-nginx_1.12.1.tgz` image with `1.12.1` tag.

{% tabs %}
{% tab title="Master node" %}

```javascript
$ sudo /opt/pf9/pf9-kube/bin/nerdctl -n k8s.io images | grep ingress
```

{% endtab %}
{% endtabs %}

5. Update the `ingress-nginx` config-map to include `annotations-risk-level: Critical`in the data section as shown below:

{% tabs %}
{% tab title="Master node" %}

```javascript
$ kubectl edit cm ingress-nginx-x -n airctl-1-xxxxxxxx-xx 
---
data:
  allow-snippet-annotations: "true"
  annotations-risk-level: Critical              # New Entry
```

{% endtab %}
{% endtabs %}

6. Update the deployments which will be listed by the below command with the correct image `v1.12.1`

{% tabs %}
{% tab title="Master node" %}

```javascript
$ kubectl get deployment -A | grep ingress

$ kubectl edit deployment -n airctl-1-xxxxxxxx-xx-kplane ingress-nginx-controller

$ kubectl edit deployment -n airctl-1-xxxxxxxx-xx ingress-nginx-controller
```

{% endtab %}
{% endtabs %}

7. Verify if pods are running as expected. Also, verify the workload cluster and UI.

{% tabs %}
{% tab title="Master node" %}

```javascript
$ kubectl get po -A | grep ingress
```

{% endtab %}
{% endtabs %}

#### **Section-2**

Below are the workaround steps to fix the vulnerability issue Monitoring deployment introduced in the Management Plane of SMCP-5.11.

1. Download and save the `kube-webhook-certgen` image for management plane monitoring:

{% tabs %}
{% tab title="Master node" %}

```javascript
$ docker pull registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.2

$ docker save registry.k8s.io/ingress-nginx/kube-webhook-certgen | gzip > webhook_certgen_1.5.2.tgz
```

{% endtab %}
{% endtabs %}

2. Copy and load image into the Management plane cluster master node:

{% tabs %}
{% tab title="Master node" %}

```javascript
$ sudo /opt/pf9/pf9-kube/bin/nerdctl load --input webhook_certgen_1.5.2.tgz --namespace k8s.io
```

{% endtab %}
{% endtabs %}

3. Helm upgrade Management plane monitoring stack \[if already installed] with new `kube-prometheus-stack-62.7.1-13.tgz tarfile`, if monitoring feature is already enabled: 3.1 Download the new kube-prometheus-stack tar file:

{% tabs %}
{% tab title="Master node" %}

```javascript
$ wget https://pf9-airctl.s3.us-west-1.amazonaws.com/pf9-kube-prometheus-helm-chart/kube-prometheus-stack-62.7.1-13.tgz
```

{% endtab %}
{% endtabs %}

```
     3.2.a  If the helm kube-prometheus-stack is already installed, upgrade it using below command:
```

{% tabs %}
{% tab title="Master node" %}

```javascript
$ helm upgrade mgmt-monitoring <path_to_kube-prometheus-stack-62.7.1-13.tgz> --namespace pf9-monitoring --set admissionWebhooks.patch.image.tag=v1.5.2
```

{% endtab %}
{% endtabs %}

Or

```
   3.2.b  If the helm kube-prometheus-stack is not installed, it can be installed as mentioned below snippet: 
```

**Reference**: <https://platform9.com/docs/PEC/management-cluster-monitoring>

{% tabs %}
{% tab title="Master node" %}

```javascript
$ helm install mgmt-monitoring -n pf9-monitoring <path_to_kube-prometheus-stack-62.7.1-13.tgz> --create-namespace
```

{% endtab %}
{% endtabs %}

## Additional Information

Reference - <https://kubernetes.io/blog/2025/03/24/ingress-nginx-cve-2025-1974/>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://platform9.com/kb/smcp/frequently-asked-questions/ingress-nginx-vulnerability-cve-2025-1974.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `build a script that syncs our docs to a CMS` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.