-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/traefik/traefik/v2 | go | < 2.10.6 | 2.10.6 |
| github.com/traefik/traefik/v3 | go | < 3.0.0-beta5 | 3.0.0-beta5 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from Traefik's Docker provider automatically creating a route for its own container. The buildConfiguration() function in the Docker provider is responsible for generating routing rules from container labels. In vulnerable versions, it didn't properly exclude the Traefik container itself from routing targets, allowing recursive requests when the container name matches the host rule. This matches the CVE description of 'automatically generated route resulting from Docker integration' and the fix mentioned in release notes ('Refuse recursive requests'). The file path and function are inferred from Traefik's architecture where Docker provider configuration is handled in pkg/provider/docker.
GoGoOngoing coverage of React2Shell