Description
Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go builds HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute router and service identities by hyphen-concatenating namespace, route name, Gateway identity, entry point, and rule index, allowing colliding Routes to overwrite another namespace's backend. This issue is fixed in 3.6.25 and 3.7.10.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
traefik traefik
>= 3.0.0, < 3.6.25affected>= 3.7.0, < 3.7.10affected
References
- https://github.com/traefik/traefik/security/advisories/GHSA-fgjj-px3w-67xx ↗
- https://github.com/traefik/traefik/pull/13580 ↗
- https://github.com/traefik/traefik/commit/a764166656f0cd337f917ac76315c381cca844f9 ↗
- https://github.com/traefik/traefik/releases/tag/v3.6.25 ↗
- https://github.com/traefik/traefik/releases/tag/v3.7.10 ↗