Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.46, 3.6.17, and 3.7.1, Traefik's Kubernetes Gateway API provider allows a tenant with HTTPRoute creation permissions to expose the REST provider handler, bypassing the providers.rest.insecure=false setting. The Gateway provider accepts any TraefikService backend reference whose name ends with @internal, making it possible to route traffic to rest@internal in addition to the intended api@internal. In shared Gateway deployments where the REST provider is enabled, this allows a low-privileged actor to gain live dynamic configuration write access to Traefik, enabling unauthorized reconfiguration of routers and services. This vulnerability is fixed in 2.11.46, 3.6.17, and 3.7.1.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
| Vendor | Product | Versions | |
|---|---|---|---|
| openshift devspaces | 3.29 | — | |
| Red Hat | Red Hat OpenShift Dev Spaces 3.29 | all versions | |
| Red Hat | Red Hat OpenShift GitOps | — | |
| traefik | traefik | < 2.11.46, >= 3.0.0-beta1, < 3.6.17, >= 3.7.0-rc.0, < 3.7.1 |
cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:* < 2.11.46cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:* ≥ 3.0.0 < 3.6.17cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:* ≥ 3.7.0 < 3.7.1Two free tools, one defence: the Sensor catches whoever probes your server; Shield stops known attackers before they reach your site.
Install it and your daily API quota goes to 30,000 lookups — nothing to apply for.