GHSA-28hp-c82p-8vqj: Traefik 3.7.11 before 3.7.15 Cross-Namespace Authorization Bypass via auth-tls-secret
Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cross-namespace check on the auth-tls-secret annotation when a cached client authentication TLS option is reused. Users who can create Ingresses can reference another namespace's CA secret already used by another Ingress, enforcing it on their own routes and learning whether it exists, without disclosure of its contents.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs permission to create Kubernetes Ingress resources. The affected behavior is in Traefik's Kubernetes Ingress NGINX provider and requires a CA secret in another namespace that has already been used by another Ingress.
What can an attacker gain through the bypass?
The attacker can make their own routes enforce client authentication using a referenced CA secret from another namespace. They can also determine whether that secret exists, but the issue does not disclose the secret's contents.
What configuration condition is required for exploitation?
The bypass occurs when Traefik reuses a cached client-authentication TLS option associated with the auth-tls-secret annotation. A cross-namespace CA secret must already have been used by another Ingress for that cached option to be available.