Microsoft Azure Kubernetes Service (AKS) administrators are facing urgent security concerns following the discovery of critical vulnerabilities in the Ingress-Nginx controller. These flaws, tracked as CVE-2025-1098 and related CVEs, could allow attackers to execute arbitrary code, escalate privileges, or intercept sensitive traffic in containerized environments.

Understanding the Threat Landscape

The vulnerabilities primarily affect AKS clusters using the popular Ingress-Nginx controller (version 1.2.0 through 1.5.3) for managing external access to services. Security researchers identified three critical attack vectors:

  • Remote Code Execution (RCE): Crafted HTTP requests can bypass validation checks
  • Privilege Escalation: Container breakout to node-level access
  • Man-in-the-Middle (MitM): TLS certificate validation bypass

Impact Analysis

Affected Components

  • AKS clusters with Ingress-Nginx add-on enabled
  • Self-managed Ingress-Nginx installations on Windows/Linux nodes
  • Hybrid deployments using Azure Arc-enabled Kubernetes

Potential Consequences

  • Unauthorized access to sensitive pod data
  • Compromise of adjacent Azure resources
  • Violation of compliance requirements (HIPAA, PCI DSS)

Microsoft's Response

Microsoft has released emergency patches through multiple channels:

# For AKS-managed clusters:
az aks upgrade --resource-group myResourceGroup --name myAKSCluster

# For self-managed controllers:
kubectl apply -f https://aka.ms/ingress-nginx-patch

Remediation Steps

Immediate Actions

  1. Identify vulnerable controllers:
    kubectl get pods -n ingress-nginx -l app.kubernetes.io/name=ingress-nginx
  2. Update components:
    - AKS: Minimum version 1.27.5
    - Ingress-Nginx: 1.5.4 or later
  3. Rotate credentials: All service account tokens and kubeconfig files

Long-Term Security Enhancements

  • Enable Azure Defender for Kubernetes
  • Implement network policies to restrict ingress/egress
  • Configure Pod Security Admission (PSA) policies

Windows-Specific Considerations

AKS Windows nodes require additional attention due to:

  • Different kernel isolation mechanisms
  • Special handling of hostPath volumes
  • Unique networking stack considerations

Microsoft recommends:

# For Windows node pools:
az aks nodepool update --os-sku Windows2022

Monitoring and Detection

Azure Monitor alerts should be configured for these indicators:

  • Unusual exec activity in ingress-nginx namespace
  • Abnormal outbound connections from controller pods
  • Configuration changes to ingress resources

Best Practices Going Forward

  • Implement GitOps for declarative configuration management
  • Use OPA/Gatekeeper for policy enforcement
  • Schedule regular vulnerability scans using Microsoft Defender for Cloud

Timeline and Disclosure

  • Discovery Date: 2025-01-15
  • Azure Security Bulletin: MSKB-40285
  • CVE Publication: 2025-02-01

Additional Resources