Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/traefik/traefik | go | >= 3.6.0, <= 3.6.22 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the Traefik Kubernetes CRD provider, specifically in how it handles serversTransport references for IngressRouteTCP resources. The advisory GHSA-42cj-m3vj-89wv provides a detailed root cause analysis, pointing to the makeTCPServersTransportKey function in pkg/provider/kubernetes/crd/kubernetes_tcp.go. This function was missing a check to validate if a namespace is allowed to make cross-provider references, a check that was present for HTTP serversTransport references. The vulnerable function would accept a serversTransport name containing an '@' (e.g., foo@file) without verifying if the namespace of the IngressRouteTCP is in the crossProviderNamespaces allowlist. This allows a low-privileged user to create an IngressRouteTCP that references a TCPServersTransport from a different, potentially more privileged provider (like the file provider), leading to an incorrect authorization vulnerability. The fix, identified by comparing the vulnerable and patched versions, was to add the missing isCrossProviderNamespaceAllowed check to the makeTCPServersTransportKey function.
Provider.makeTCPServersTransportKeypkg/provider/kubernetes/crd/kubernetes_tcp.go
Provider.createLoadBalancerServerTCPpkg/provider/kubernetes/crd/kubernetes_tcp.go
Provider.loadIngressRouteTCPConfigurationpkg/provider/kubernetes/crd/kubernetes_tcp.go