CyberRota Analysis
AI-GeneratedKubernetes deployments using Traefik versions 3.0.0 to 3.6.25 and 3.7.10 are vulnerable due to a flaw in the Gateway API provider that allows for route identity collisions, potentially enabling one namespace's routes to overwrite another's backend services. This could lead to unauthorized access or service disruptions. Organizations utilizing these Traefik versions in their Kubernetes environments should prioritize patching to the fixed versions 3.6.25 or 3.7.10 to mitigate the risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go builds HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute router and service identities by hyphen-concatenating namespace, route name, Gateway identity, entry point, and rule index, allowing colliding Routes to overwrite another namespace's backend. This issue is fixed in 3.6.25 and 3.7.10.