Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the…

What to know

What it is

Traefik versions 3.7.0-ea.1 to 3.7.15 contain an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider, allowing unauthenticated attackers to reach backends requiring client certificates.

Affected

{'products': ['Traefik'], 'packages': [], 'versions': ['3.7.0-ea.1', '3.7.1', '3.7.2', '3.7.3', '3.7.4', '3.7.5', '3.7.6', '3.7.7', '3.7.8', '3.7.9', '3.7.10', '3.7.11', '3.7.12', '3.7.13', '3.7.14', '3.7.15']}

Fix

Upgrade to version 3.7.15 or later

Exploitation

No known exploitation

Not confirmed. 3.7.1, 3.7.2, 3.7.3, 3.7.4, 3.7.5, 3.7.6, 3.7.7, 3.7.8 isn't in the advisory. Check the vendor's advisory before acting on this.