Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-proxy-set-headers` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-02-06 | 6 | Disclosure3General3 |
| 2026-02-11 | 1 | Disclosure1 |
CVE-2025-15566: ingress-nginx auth-proxy-set-headers nginx configuration injection - https://github.com/kubernetes/kubernetes/issues/136789
Post summary
The text announces CVE‑2025‑15566, a configuration injection flaw in ingress‑nginx’s auth‑proxy‑set‑headers, with a link to a related GitHub issue.
CVE-2025-15566: ingress-nginx auth-proxy-set-headers nginx configuration injection - https://github.com/kubernetes/kubernetes/issues/136789
Post summary
A GitHub issue references CVE-2025-15566, noting an ingress-nginx auth-proxy-set-headers configuration injection vulnerability, but offers no further technical or remediation details.
no this cve, CVE-2025-15566 is not from the set earlier this week - this is just the non-stop security nightmare that is kubernetes https://t.co/jIcxg8dr0D
Post summary
The tweet merely states that CVE‑2025‑15566 is not from a previously mentioned set and calls it a Kubernetes security nightmare, with no further technical or actionable detail.
CVE-2025-15566 (CVSS:8.8, HIGH) is Awaiting Analysis. A security issue was discovered in ingress-nginx where the `http://nginx.ingress.kubernetes.io/auth-proxy-set-headers` Ingress ..https://nvd.nist.gov/vuln/detail/CVE-2025-15566 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post announces a new high‑severity vulnerability (CVE‑2025‑15566) in ingress‑nginx, detailing its CVSS score and the specific auth‑proxy header involved, with no evidence of exploitation or available patches.
CVE-2025-15566 #devopsish #kubernetes #cve https://github.com/kubernetes/kubernetes/issues/136789
Post summary
The post merely references CVE‑2025‑15566 and links to a GitHub issue, providing no additional details about the vulnerability, exploitation, or mitigation.
CVE-2025-15566 Kubernetes Ingress-Nginx Arbitrary Code Execution via Header Injection Annotation https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-15566
Post summary
The post offers a concise title and a link to a vulnerability listing, mentioning that Kubernetes Ingress‑Nginx can suffer arbitrary code execution via header injection, but it provides no further details on PoC, exploitation, patches, or active attacks.
CVE-2025-15566 A security issue was discovered in ingress-nginx where the `http://nginx.ingress.kubernetes.io/auth-proxy-set-headers` Ingress annotation can be used to inject configuration… https://www.cve.org/CVERecord?id=CVE-2025-15566
Post summary
The text discloses a vulnerability in ingress-nginx where the auth-proxy-set-headers annotation can be exploited to inject configuration settings. No PoC, exploit code, active exploitation, or patch information is provided.