Traefik is an open-source edge router that makes publishing services a fun and easy experience. Prior to 2.11.54, 3.6.25, and 3.7.10, cross-namespace @kubernetescrd references are not rejected for TraefikService backend references resolved by the service resolver. A tenant confined by RBAC to a single namespace can therefore bind its own router to a TraefikService owned by another namespace and expose or reroute that namespaces backend, defeating the namespace isolation allowCrossNamespace=false is meant to enforce. This issue is fixed in version 2.11.54, 3.6.25, 3.7.10.
Weakness
The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Traefik | Traefik | * | 2.11.54 (excluding) |
| Traefik | Traefik | 3.0.0 (including) | 3.6.25 (excluding) |
| Traefik | Traefik | 3.7.0 (including) | 3.7.10 (including) |
Potential Mitigations
References
- https://github.com/traefik/traefik/commit/65ebf4b47fbdc33e3856803a5844a404e094d52d
- https://github.com/traefik/traefik/releases/tag/v2.11.54
- https://github.com/traefik/traefik/releases/tag/v3.6.25
- https://github.com/traefik/traefik/releases/tag/v3.7.10
- https://github.com/traefik/traefik/security/advisories/GHSA-62fc-8686-hfmq