Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN854 _____________________________________________________________________ DATE : 21/08/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Traefik (Go) versions prior to. ===================================================================== https://github.com/traefik/traefik/security/advisories/GHSA-5w68-77r2-r64c https://github.com/traefik/traefik/security/advisories/GHSA-j994-9gqj-9hwq https://github.com/traefik/traefik/security/advisories/GHSA-m6wx-622r-48r9 _____________________________________________________________________ Complete authentication bypass in the `digestAuth` middleware Critical rtribotte published GHSA-5w68-77r2-r64c Package Traefik (Go) Affected versions <= v2.11.54 >= v3.0.0, <= v3.7.10 Patched versions v2.11.55 v3.7.11 Description Summary There is a critical severity vulnerability in Traefik's digestAuth middleware. The middleware's secret provider returned an empty string for a username absent from the configured user list, instead of signalling that no such user exists, and the pinned digest library accepted that empty string as the user's HA1. Every other input to the digest computation is either chosen by the client or handed to it in the 401 challenge, so the expected response digest becomes fully computable and any unauthenticated remote client can pass the check with an arbitrary username and no password, on any route protected by digestAuth — including the dashboard and API when they are protected this way. The fix updates the github.com/containous/go-http-auth fork so that an unknown user is rejected rather than given an empty secret. Every v1, v2 and v3 release shipping the middleware is affected; the v1 line, the v2 minors below v2.11 and the v3 minors below v3.7 are no longer maintained and will not receive a patch of their own, so users running them should upgrade to a maintained, patched release. Patches https://github.com/traefik/traefik/releases/tag/v2.11.55 https://github.com/traefik/traefik/releases/tag/v3.7.11 For more information If you have any questions or comments about this advisory, please open an issue. Original Description Severity Critical 9.3/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements None Privileges Required None User interaction None Vulnerable System Impact Metrics Confidentiality High Integrity High Availability High Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE ID No known CVE Weaknesses Weakness CWE-287 Weakness CWE-303 Credits @matiasinsaurralde matiasinsaurralde Reporter _____________________________________________________________________ Same-host Ingress TLS option conflict disables client-certificate authentication High rtribotte published GHSA-j994-9gqj-9hwq Package Traefik (Go) Affected versions >= v3.7.0, <= v3.7.10 Patched versions v3.7.11 Description Summary There is a high severity vulnerability in Traefik's Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress carrying the nginx.ingress.kubernetes.io/auth-tls-secret annotation was named after the Ingress namespace and name, so two Ingress objects sharing the same host, the same client CA secret and the same client-authentication mode produced two distinct TLS options for that host name. Traefik treats that as a TLS options conflict and falls back to the entry point's default TLS configuration, which does not request a client certificate, so a route configured with nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" becomes reachable without one. The generated option name is now derived from the client CA secret and the client-authentication mode alone, so Ingresses expressing the same mTLS policy resolve to a single TLS option. Only the v3.7 line is affected: the Ingress NGINX provider's client-authentication handling was introduced in v3.7.0, and neither Traefik v2 nor the v3 lines up to v3.6 carry it. Patches https://github.com/traefik/traefik/releases/tag/v3.7.11 For more information If you have any questions or comments about this advisory, please open an issue. Original Description Severity High 8.2/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements Present Privileges Required None User interaction None Vulnerable System Impact Metrics Confidentiality High Integrity None Availability None Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVE ID No known CVE Weaknesses Weakness CWE-287 Weakness CWE-295 Credits @james-yusuke james-yusuke Reporter _____________________________________________________________________ Kubernetes Ingress service middleware bypasses crossProviderNamespaces High rtribotte published GHSA-m6wx-622r-48r9 Package Traefik (Go) Affected versions >= v3.7.1, <= v3.7.10 Patched versions v3.7.11 Description Summary There is a medium severity vulnerability in Traefik's Kubernetes Ingress provider. The providers.kubernetesIngress.crossProviderNamespaces allowlist was enforced for the router.middlewares and service.serverstransport annotations, but not for the traefik.ingress.kubernetes.io/service.middlewares Service annotation, whose value was copied into the generated dynamic service without checking the Service's namespace. A tenant restricted to a namespace excluded from the allowlist could therefore attach an operator-owned middleware from another provider to its own Service, and, when that middleware injects a backend credential, recover the credential at a backend it controls. Only the v3.7 line from v3.7.1 onwards is affected: the crossProviderNamespaces option was introduced in v3.7.1, and neither Traefik v2 nor the v3 lines up to v3.6 carry it. Patches https://github.com/traefik/traefik/releases/tag/v3.7.11 For more information If you have any questions or comments about this advisory, please open an issue. Original Description Severity High 7.0/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements Present Privileges Required Low User interaction None Vulnerable System Impact Metrics Confidentiality High Integrity None Availability None Subsequent System Impact Metrics Confidentiality High Integrity None Availability None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N CVE ID No known CVE Weaknesses No CWEs Credits @velgusgus599 velgusgus599 Reporter ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================