Threats tagged 'ghsa-mvh9-fv5r-qhpj'

Traefik versions 3.7.11 through 3.7.14 contain an authorization bypass vulnerability in the Kubernetes Ingress NGINX provider. This flaw allows users with permission to create Ingress resources to bypass cross-namespace checks on the auth-tls-secret annotation when a cached client TLS authentication option is reused. Exploiting this, an attacker can reference a CA secret from another namespace already used by a different Ingress, enforcing it on their own routes and determining its existence without accessing the secret's contents.