Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN816 _____________________________________________________________________ DATE : 04/08/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Traefik (Go) versions prior to 2.11.53, 3.6.24, 3.7.9. ===================================================================== https://github.com/traefik/traefik/security/advisories/GHSA-fgjj-px3w-67xx https://github.com/traefik/traefik/security/advisories/GHSA-62fc-8686-hfmq https://github.com/traefik/traefik/security/advisories/GHSA-6765-c87h-8mrf _____________________________________________________________________ Gateway API route identity collision allows cross-namespace backend hijacking High rtribotte published GHSA-fgjj-px3w-67xx Package Traefik (Go) Affected versions >= v3.0.0, <= v3.6.24 >= v3.7.0, <= v3.7.9 Patched versions v3.6.25 v3.7.10 Description Summary There is a high severity vulnerability in Traefik's Kubernetes Gateway API provider. Router and service identities for HTTPRoute, GRPCRoute, TCPRoute and TLSRoute objects were built by hyphen-concatenating the route namespace, the route name, the Gateway identity, the entry point and the rule index, a construction that is not injective because Kubernetes names may themselves contain hyphens. Two distinct Routes attached to the same Gateway with equivalent match rules can therefore produce the same identity, and the Route loaded later silently overwrites the earlier one, so a tenant able to create an accepted Route in a colliding namespace/name combination can redirect another namespace's traffic to a backend it controls. All Traefik v3 minor lines areaffected; the lines older than v3.6 are no longer maintained and will not receive a patch of their own, so users running them should upgrade to a maintained, patched release. Patches https://github.com/traefik/traefik/releases/tag/v3.6.25 https://github.com/traefik/traefik/releases/tag/v3.7.10 For more information If you have any questions or comments about this advisory, please open an issue. Original Description Severity High 7.6/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements Present Privileges Required Low User interaction None Vulnerable System Impact Metrics Confidentiality High Integrity High Availability None Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVE ID No known CVE Weaknesses Weakness CWE-694 Credits @hussst hussst Reporter _____________________________________________________________________ `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef Moderate rtribotte published GHSA-62fc-8686-hfmq Package Traefik (Go) Affected versions <= v2.11.53 >= v3.0.0, <= v3.6.24 >= v3.7.0, <= v3.7.9 Patched versions v2.11.54 v3.6.25 v3.7.10 Description Summary There is a medium severity vulnerability in Traefik's Kubernetes CRD provider. When providers.kubernetesCRD.allowCrossNamespace is disabled — the default — cross-namespace @kubernetescrd references are rejected for middlewares, TLS options and HTTP/TCP ServersTransports, but the same restriction was not applied to TraefikService backend references resolved by the service resolver. A tenant confined by RBAC to a single namespace can therefore bind its own router to a TraefikService owned by another namespace and expose or reroute that namespace's backend, defeating the namespace isolation allowCrossNamespace=false is meant to enforce. Traefik v2 releases and the unmaintained v3 minor lines below v3.6 are affected and will not receive a patch on their own line; the remedy for those users is upgrading to a maintained, patched release. Patches https://github.com/traefik/traefik/releases/tag/v2.11.54 https://github.com/traefik/traefik/releases/tag/v3.6.25 https://github.com/traefik/traefik/releases/tag/v3.7.10 For more information If you have any questions or comments about this advisory, please open an issue. Original Description Severity Moderate 4.8/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Local Attack Complexity Low Attack Requirements None Privileges Required Low User interaction None Vulnerable System Impact Metrics Confidentiality Low Integrity Low Availability None Subsequent System Impact Metrics Confidentiality Low Integrity Low Availability None CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVE ID No known CVE Weaknesses Weakness CWE-653 Weakness CWE-863 Credits @ttzero25 ttzero25 Reporter _____________________________________________________________________ BasicAuth singleflight key collision allows authenticated identity spoofing Low rtribotte published GHSA-6765-c87h-8mrf Package Traefik (Go) Affected versions >= v3.6.11, <= v3.6.24 >= v3.7.0, <= v3.7.9 Patched versions v3.6.25 v3.7.10 Description Summary There is a low severity vulnerability in Traefik's BasicAuth middleware. Concurrent password verifications are deduplicated through a singleflight group whose key was the delimiter-free concatenation of the submitted password and the stored secret, so a request carrying an unconfigured username — whose secret is empty — can produce the same key as a configured user's valid request and receive that request's successful result. Exploitation requires the attacker to already hold a valid credential and to read the stored password hash, which is only reachable through paths that are themselves privileged: the API is documented as admin-only, the Kubernetes path requires read access to the Secret, and the Docker path requires access to the socket. The key now encodes the password length as a prefix, so distinct (password, secret) pairs can no longer collide. Only the v3.6 line from v3.6.11 onwards and the v3.7 line are affected; earlier v3 releases and the v2 line do not carry the vulnerable deduplication path. Patches https://github.com/traefik/traefik/releases/tag/v3.6.25 https://github.com/traefik/traefik/releases/tag/v3.7.10 For more information If you have any questions or comments about this advisory, please open an issue. Original Description Severity Low 2.1/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements Present Privileges Required High User interaction None Vulnerable System Impact Metrics Confidentiality Low Integrity Low Availability None Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVE ID No known CVE Weaknesses Weakness CWE-287 Credits @hussst hussst Reporter ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================