Technical Service Bulletin (2025-24)

Subject: 

Redpanda is aware of several recently published CVEs, focused on ingress-nginx, and while no attack vector impacting Redpanda usage of nginx has been identified, out of an abundance of caution we will be upgrading all potentially impacted services.

Summary: 

Redpanda is aware of several recently published CVEs, focused on ingress-nginx, and while no attack vector impacting Redpanda usage of nginx has been identified, out of an abundance of caution we will be upgrading all potentially impacted services.

• CVE-2025-24513 (CVSS score: 4.8) – An improper input validation vulnerability that could result in directory traversal within the container, leading to denial-of-service (DoS) or limited disclosure of secret objects from the cluster when combined with other vulnerabilities
• CVE-2025-24514 (CVSS score: 8.8) – The auth-url Ingress annotation can be used to inject configuration into NGINX, resulting in arbitrary code execution in the context of the ingress-nginx controller and disclosure of secrets accessible to the controller
• CVE-2025-1097 (CVSS score: 8.8) – The auth-tls-match-cn Ingress annotation can be used to inject configuration into NGINX, resulting in arbitrary code execution in the context of the ingress-nginx controller and disclosure of secrets accessible to the controller
• CVE-2025-1098 (CVSS score: 8.8) – The mirror-target and mirror-host Ingress annotations can be used to inject arbitrary configuration into NGINX, resulting in arbitrary code execution in the context of the ingress-nginx controller and disclosure of secrets accessible to the controller
• CVE-2025-1974 (CVSS score: 9.8) – An unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller under certain conditions

To mitigate any potential risk we are upgrading ingress-nginx-controller from version 1.10.4 to version 1.11.5. 

Severity: 

High

Redpanda Products Affected:

• Redpanda Cloud - BYOC
• Redpanda Cloud - Dedicated
• Redpanda Cloud - Serverless

Release Affected:

All Releases

Impact: 

Redpanda has not identified any attack vectors for these CVEs and does not believe there will be any impact to users.  

To resolve the issues we will be performing upgrades to ingress-nginx across our cloud base, and some clusters will experience a rolling restart, similar to regular cluster upgrades. 

Action required: 

There are no actions needed by customers, Redpanda cloud teams are currently working to upgrade to ingress-nginx version 1.11.5 to mitigate the listed CVEs. 

Redpanda has identified the needed mitigation which, depending on the cluster version, can include a rolling restart of the cluster. To reduce any potential impact from rolling restarts outside of maintenance windows our teams will implement the mitigation during each clusters next normal maintenance window for clusters that require rolling restarts. 

Clusters that do not require a rolling restart will have the mitigation applied as soon as possible, and there is no expected impact from the mitigation. 

 

Questions? If you have any questions on this TSB, or need further guidance, please reach out Redpanda Support.