Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefiks Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go builds HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute router and service identities by hyphen-concatenating namespace, route name, Gateway identity, entry point, and rule index, allowing colliding Routes to overwrite another namespaces backend. This issue is fixed in 3.6.25 and 3.7.10.
Weakness
The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Traefik | Traefik | 3.0.0 (including) | 3.6.25 (excluding) |
| Traefik | Traefik | 3.7.0 (including) | 3.7.10 (excluding) |
Potential Mitigations
References
- https://github.com/traefik/traefik/commit/a764166656f0cd337f917ac76315c381cca844f9
- https://github.com/traefik/traefik/pull/13580
- https://github.com/traefik/traefik/releases/tag/v3.6.25
- https://github.com/traefik/traefik/releases/tag/v3.7.10
- https://github.com/traefik/traefik/security/advisories/GHSA-fgjj-px3w-67xx