CVE-2025-14727: Rewrite Target Validation in NGINX Ingress Controller

Successful exploitation of CVE-2025-14727 could allow an attacker to craft malicious annotations within Kubernetes Ingress resources. These annotations, specifically the nginx.org/rewrite-target parameter, are used to define how requests are rewritten before being passed to the backend server. By manipulating this parameter, an attacker might be able to redirect traffic to unintended destinations, bypass security controls, or even execute arbitrary code on the backend server. The potential blast radius depends on the backend services exposed by the Ingress Controller, potentially impacting sensitive data and critical applications. This vulnerability highlights the importance of carefully validating all user-supplied input within Kubernetes manifests.

1. Reserved2025-12-15
2. Published2025-12-17
3. Modified2026-02-26
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-14727 is to upgrade the NGINX Ingress Controller to version 5.3.1 or later. If immediate upgrading is not possible, consider implementing stricter validation of Ingress resource manifests to prevent the injection of malicious nginx.org/rewrite-target annotations. This could involve using Kubernetes admission controllers or custom validation scripts. Additionally, review existing Ingress resources for any suspicious annotations. After upgrading, confirm the fix by deploying a test Ingress resource with a deliberately malformed nginx.org/rewrite-target annotation and verifying that it is rejected by the controller.