Description
Traefik is an open-source edge router that makes publishing services a fun and easy experience. Prior to 2.11.54, 3.6.25, and 3.7.10, cross-namespace @kubernetescrd references are not rejected for TraefikService backend references resolved by the service resolver. A tenant confined by RBAC to a single namespace can therefore bind its own router to a TraefikService owned by another namespace and expose or reroute that namespace's backend, defeating the namespace isolation allowCrossNamespace=false is meant to enforce. This issue is fixed in version 2.11.54, 3.6.25, 3.7.10.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
traefik traefik
< 2.11.54affected>= 3.0.0, < 3.6.25affected>= 3.7.0, < 3.7.10affected
References
- https://github.com/traefik/traefik/security/advisories/GHSA-62fc-8686-hfmq ↗
- https://github.com/traefik/traefik/commit/65ebf4b47fbdc33e3856803a5844a404e094d52d ↗
- https://github.com/traefik/traefik/releases/tag/v2.11.54 ↗
- https://github.com/traefik/traefik/releases/tag/v3.6.25 ↗
- https://github.com/traefik/traefik/releases/tag/v3.7.10 ↗