Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its…

What to know

What it is

Traefik versions 3.7.0 to 3.7.14 contain an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider. An attacker can impersonate mTLS identities by sending specific headers.

Affected

{'products': ['Traefik'], 'packages': [], 'versions': ['3.7.0', '3.7.1', '3.7.2', '3.7.3', '3.7.4', '3.7.5', '3.7.6', '3.7.7', '3.7.8', '3.7.9', '3.7.10', '3.7.11', '3.7.12', '3.7.13', '3.7.14']}

Fix

Upgrade to version 3.7.14 or later

Exploitation

No known exploitation

Not confirmed. 3.7.1, 3.7.2, 3.7.3, 3.7.4, 3.7.5, 3.7.6, 3.7.7, 3.7.8 isn't in the advisory. Check the vendor's advisory before acting on this.