> For the complete documentation index, see [llms.txt](https://waf-doc.inext.checkpoint.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://waf-doc.inext.checkpoint.com/references/cve-2025-1097-cve-2025-1098-cve-2025-24514-cve-2025-1974-ingress-nginx-controller-rce-critical.md).

# CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, CVE-2025-1974: Ingress NGINX Controller RCE (Critical)

### Background

On March 24, 2025, WIZ Research disclosed critical vulnerabilities in the Kubernetes Ingress NGINX Controller that allow unsensitized user input to be injected into the temporary NGINX configuration file during validation. This unsensitized input, when processed by the nginx -t command, can lead to remote code execution (RCE) on the pod running the controller.

Additional information can be found in [this blog](https://www.openappsec.io/post/remediation-for-ingress-nginx-controller-vulnerability).

**Important Note:** In order to exploit this vulnerability, the attacker must have network access to the ingress controller’s pod to send arbitrary AdmissionReview requests. While such access is not available by default in many environments, it can be achieved if the attacker gains a foothold within the cluster - such as through compromising another pod - or by leveraging SSRF vulnerabilities. This requirement raises the barrier for exploitation, although it does not eliminate the risk.

### Updates to CloudGuard WAF Nano Agent for Kubernetes (K8s)

Our security team verified that our Helm chart deployment of open-appsec / Check Point CloudGuard WAF - which uses the Ingress NGINX Controller - was affected by these vulnerabilities. To address this issue, within 24 hours, we provided the fix by updating the controller to version **1.21.1**, which includes all the necessary patches and improvements to ensure proper sanitization of user inputs during configuration generation.

To keep your systems safe, we recommend updating your NGINX helm. **You can find all detailed deployment steps with updated Helm chart versions here:**

{% content-ref url="/pages/Bh4S8ywHQAjPeucs0PZS" %}
[Kubernetes](/getting-started/deploy-enforcement-point/kubernetes.md)
{% endcontent-ref %}

We highly recommend updating your deployment as soon as possible to ensure everything stays secure.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://waf-doc.inext.checkpoint.com/references/cve-2025-1097-cve-2025-1098-cve-2025-24514-cve-2025-1974-ingress-nginx-controller-rce-critical.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.