Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/traefik/traefik/v2 | go | <= 2.11.53 | 2.11.54 |
| github.com/traefik/traefik/v3 | go | >= 3.0.0, <= 3.6.24 | 3.6.25 |
| github.com/traefik/traefik/v3 | go | >= 3.7.0, <= 3.7.9 | 3.7.10 |
| github.com/traefik/traefik | go | <= 1.7.34 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the nameAndService function within the pkg/provider/kubernetes/crd/kubernetes_http.go file. The provided patch 65ebf4b47fbdc33e3856803a5844a404e094d52d clearly shows the addition of a security check that was previously missing. Specifically, the new code block verifies if allowCrossNamespace is disabled and if the service name includes a cross-namespace reference using the @kubernetescrd provider. Before this patch, the function failed to perform this check for TraefikService backends, leading to a bypass of namespace isolation. An attacker could create an IngressRoute in their own namespace that references a TraefikService in a different namespace, allowing them to expose or reroute traffic to that service. The vulnerable function, configBuilder.nameAndService, is the point where this malicious reference is processed without proper validation.
configBuilder.nameAndServicepkg/provider/kubernetes/crd/kubernetes_http.go