R-1303 (P2): the security watch — spike: which notice sources catch the controls; R-1304 (P3): traefik v3.7.13 inside 12 October advisories
gates / gates (push) Successful in 1m55s
gates / gates (push) Successful in 1m55s
This commit is contained in:
admin committed
1 parent
ae3db89ab3
commit
97ae7086c0
8 files changed
+228
-1
No files matched your search
@@ -0,0 +1,65 @@
|
||||
# SPIKE — which security-notice sources work (security watch, R-1303), 2026-10-26 evening
|
||||
|
||||
Measured from DooPlex (the CI runner is a k3s pod on DooPlex with the same egress; its own reach is proven by the live
|
||||
run, `LIVE.md`). Raw answers: `raw/`.
|
||||
|
||||
## The controls
|
||||
|
||||
| Control | What it is | Our pin |
|
||||
|---|---|---|
|
||||
| **P1 cloudflared** | Cloudflare's eMudhra notice, 2026-10-20: fixed in 2026.10.2 (image trust store) | was 2026.9.3 (R-1300) |
|
||||
| **P2 traefik** | GHSA-fh26-gfpp-7xxx (and 11 more, Oct 2026), fixed v3.7.14–v3.7.16; and the older set, e.g. 81 advisories for v3.1.2 | v3.7.13 |
|
||||
| **P3 vaultwarden** | GHSA-wc45-m6pv-rrf9 and five more (2026-10-03), fixed 1.37.0 | 1.37.4 |
|
||||
| **P4 immich** | GHSA-q89f-h332-8q2h (2026-09-28, high: SVG upload → RCE), fixed v3.2.4 | v3.2.4 |
|
||||
| **P5 nextcloud** | advisories published in `nextcloud/security-advisories` (not in `nextcloud/server`) | 34.0.4 |
|
||||
| **P6 Go builder** | GO-2026-6809 (R-972), fixed in Go 1.27.3 | golang 1.27.3 |
|
||||
| **N negative** | vaultwarden 1.37.4 vs its advisories; traefik v3.7.16 vs GHSA-hrpp (≤ v3.7.15); Go 1.27.3 | — |
|
||||
|
||||
## The table
|
||||
|
||||
| Source | P1 cloudflared | P2 traefik | P3 vaultwarden | P4 immich | P5 nextcloud | P6 Go | Negative | Cost per night | Key |
|
||||
|---|---|---|---|---|---|---|---|---|---|
|
||||
| **GitHub per-repo security advisories** (`/repos/O/R/security-advisories`) | **no** (only 2 old Windows advisories) | **yes** — 12 affect v3.7.13 | **yes** (6, range ≤ 1.36.0) | **yes** | **yes**, from `nextcloud/security-advisories` (100+, paged) | n/a | **correct** (1.37.4 and v3.7.16 not affected) | 1 request per repo (+1 per 100 more) ≈ 85–90 | 60/hour without a key, **shared by every DooPlex client**; a 304 still counts (measured: 51 → 50). 5000/hour with a key |
|
||||
| **OSV.dev** `query` | no (`github.com/cloudflare/cloudflared` at 2026.9.3: 0) | **old only** (v3.1.2: 81; v3.7.13: 0 — none of October's) | no (not a package) | no | no (Packagist `nextcloud/server`: 0) | **yes** (Go 1.27.2 → GO-2026-6809) | **correct** (Go 1.27.3: 0) | 1 POST per Go builder | none |
|
||||
| **GitHub global advisories** (`/advisories?affects=`) | no | no (reviewed only; October's are not) | no | no | no | — | — | 1 per item | same as above |
|
||||
| **GitHub release feed** (`/O/R/releases.atom`, newest 10, full notes) | no (cloudflared's release body is checksums only) | — | **yes** (1.37.0, 1.37.4 name GHSA ids) | **partly** (v3.3.5 says „security"; v3.2.4 is older than the 10 in the feed) | — | — | — | 1 per repo, **no API quota** (measured: core count unchanged) | none |
|
||||
| **cloudflared `RELEASE_NOTES`** (raw file) | **no** for 2026.10.2 (no marker) — but Cloudflare marks security fixes `VULN-` (12 so far, e.g. 2026.10.4 VULN-176088) | — | — | — | — | — | — | 1 | none |
|
||||
| **Cloudflare blog feed** (`blog.cloudflare.com/rss/`, full text, ~2 weeks) | **YES** — „8 eMudhra certificates are compromised" (2026-10-20) names cloudflared | — | — | — | — | — | — | 1 | none |
|
||||
| **Registry tags** (Docker Hub, ghcr.io anonymous token, `lscr.io` = Docker Hub `linuxserver/*`) | BEHIND only (2026.10.2 existed) | BEHIND only | — | — | — | — | — | 1–3 per image | none |
|
||||
|
||||
## The choice (the smallest set that catches every positive control)
|
||||
|
||||
1. **GitHub per-repo security advisories** — catches P2, P3, P4, P5. The primary source.
|
||||
2. **Cloudflare blog feed + cloudflared `RELEASE_NOTES` `VULN-` markers** — the only automated way to P1 (the blog);
|
||||
`VULN-` catches Cloudflare's other security releases (2026.10.0, 2026.10.4).
|
||||
3. **OSV, Go stdlib only** — P6, for the Go builder pins of the controller and the hub.
|
||||
4. **GitHub release feeds** — no quota; catches apps that write „security"/CVE/GHSA in their notes but publish no
|
||||
advisories (a second net, not a primary).
|
||||
5. **Registry tags** — BEHIND, as `check-infra-pins.py` does, for every pin.
|
||||
|
||||
Dropped: OSV for apps (it found nothing the per-repo advisories did not, and nothing from October), GitHub's global
|
||||
advisory search (reviewed advisories only).
|
||||
|
||||
## What the watch CANNOT see
|
||||
|
||||
- **A fix announced only by mail, or on a blog we do not read.** P1 is caught only because Cloudflare's blog names
|
||||
cloudflared in full text; a vendor that announces in a mail or a forum is invisible.
|
||||
- **A security fix nobody calls one** (a base-image or trust-store bump with plain release notes, like cloudflared
|
||||
2026.10.2's „bump distroless image"). It shows only as BEHIND (weekly).
|
||||
- **Packages inside our own images:** the Alpine/Debian packages in the controller, hub and Samba images (Samba's
|
||||
version is whatever Alpine 3.24 ships; Debian's and Alpine's security trackers are not read). BEHIND on the base image's
|
||||
point release is the only signal.
|
||||
- **Floating tags** (`redis:7-alpine`, `postgres:16-…`, `mariadb:12.3`): there is no exact version to match a range
|
||||
against; they are listed as FLOATING, and a pull at install takes the line's newest.
|
||||
- **Apps with no GitHub home or no notice practice** (PostgreSQL, MariaDB, Plex, Emby, OnlyOffice's server, the
|
||||
linuxserver wrappers): only BEHIND, plus release-feed words where a feed exists.
|
||||
- **Without a key:** the advisory lists of the apps are read every second night (about 40 a night), the box programs
|
||||
every night. The operator said yes to a key (2026-10-26); until it exists the watch runs in this mode and says so.
|
||||
|
||||
## Facts measured on the way
|
||||
|
||||
- Our traefik pin **v3.7.13** is inside 12 advisories of October 2026 (fixed v3.7.14–v3.7.16). Our config uses the
|
||||
docker and file providers, no Kubernetes ingress, no FastProxy, no NTLM/Negotiate backend; ForwardAuth goes to the
|
||||
controller. None of the 12 seem to apply → **FILED: R-1304** (raise in the next controller release).
|
||||
- A Gitea Actions secret cannot be named `GITHUB_…` (Gitea reserves the `GITHUB_` and `GITEA_` prefixes), so the CI
|
||||
secret is **`GH_ADVISORY_TOKEN`**, and the same name in CC's store.
|
||||
@@ -0,0 +1,20 @@
|
||||
import json,sys,urllib.request
|
||||
def q(body):
|
||||
r=urllib.request.Request('https://api.osv.dev/v1/query',data=json.dumps(body).encode(),headers={'Content-Type':'application/json'})
|
||||
return json.load(urllib.request.urlopen(r,timeout=30)).get('vulns',[])
|
||||
cases=[
|
||||
('cloudflared 2026.9.3 (Go module)', {'package':{'name':'github.com/cloudflare/cloudflared','ecosystem':'Go'},'version':'2026.9.3'}),
|
||||
('cloudflared pseudo v0', {'package':{'name':'github.com/cloudflare/cloudflared','ecosystem':'Go'}}),
|
||||
('Go stdlib 1.26.8 (cloudflared 2026.9.3 build)', {'package':{'name':'stdlib','ecosystem':'Go'},'version':'1.26.8'}),
|
||||
('traefik v3 3.7.13', {'package':{'name':'github.com/traefik/traefik/v3','ecosystem':'Go'},'version':'3.7.13'}),
|
||||
('traefik v3 3.7.16 (negative?)', {'package':{'name':'github.com/traefik/traefik/v3','ecosystem':'Go'},'version':'3.7.16'}),
|
||||
('vaultwarden 1.36.0 (crates.io)', {'package':{'name':'vaultwarden','ecosystem':'crates.io'},'version':'1.36.0'}),
|
||||
('immich 3.2.2 (npm)', {'package':{'name':'immich','ecosystem':'npm'},'version':'3.2.2'}),
|
||||
('nextcloud/server 29.0.0 (Packagist)', {'package':{'name':'nextcloud/server','ecosystem':'Packagist'},'version':'29.0.0'}),
|
||||
('nextcloud/server 34.0.4 (Packagist, ours)', {'package':{'name':'nextcloud/server','ecosystem':'Packagist'},'version':'34.0.4'}),
|
||||
('debian ca-certificates', {'package':{'name':'ca-certificates','ecosystem':'Debian:13'}}),
|
||||
]
|
||||
for name,b in cases:
|
||||
try:
|
||||
v=q(b); print(f'{name}: {len(v)}', [x['id'] for x in v][:8])
|
||||
except Exception as e: print(name,'ERROR',e)
|
||||
@@ -0,0 +1,2 @@
|
||||
GHSA-7mjv-x3jf-545x 2023-03-21 high | Local Privilege Escalation Vulnerability in cloudflared's Installer | windows 32-bit:cloudflared | <=2023.3.0 -> 2023.3.1
|
||||
GHSA-hgwp-4vp4-qmm2 2020-09-16 medium | Local Privilege Escalation in cloudflared | : | < 2020.8.1 -> 2020.8.1
|
||||
+30
@@ -0,0 +1,30 @@
|
||||
GHSA-wc45-m6pv-rrf9 2026-10-03 medium | Send access limits not enforced on the new Send access endpoints | rust:vaultwarden | >1.36.0, < 1.37.0 -> 1.37.0
|
||||
GHSA-jq2g-h4xr-4mcr 2026-10-03 medium | Cipher Ownership Confusion in Organization Import | rust:vaultwarden | ≤ 1.36.0 -> 1.37.0
|
||||
GHSA-96f7-78q5-j345 2026-10-03 medium | Unauthenticated WebSocket connection flooding on /notifications/anonymous-hub (resource-ex | rust:vaultwarden | <= 1.36.0 -> 1.37.0
|
||||
GHSA-f3qw-qg77-hmm4 2026-10-03 medium | IDOR in Organization Import Allows Unauthorized Data Injection | rust:vaultwarden | ≤ 1.36.0 -> 1.37.0
|
||||
GHSA-vh5m-fc9v-m84g 2026-10-03 medium | SSRF filter bypass (regex not applied post-resolution) | rust:vaultwarden | <=1.36.0 -> 1.37.0
|
||||
GHSA-xwf8-pjh7-h589 2026-10-03 medium | Cross-organization full cipher access via unguarded full-access-group query | rust:vaultwarden | <= 1.36.0 -> 1.37.0
|
||||
GHSA-rxhg-2pw9-vf25 2026-10-03 medium | Send max_access_count can be exceeded by concurrent access requests | rust:vaultwarden | <= 1.36.0 -> 1.37.0
|
||||
GHSA-88qc-6ch9-mc3j 2026-10-03 medium | Directory-connector member import (ldap_import) skips org-policy enforcement (check_user_a | rust:vaultwarden | <= 1.36.0 -> 1.37.0
|
||||
GHSA-455c-vgg9-jxw8 2026-10-03 medium | Failed cipher share leaves a cross-organization collection link that grants access to the | rust:vaultwarden | < 1.37.0 -> 1.37.0
|
||||
GHSA-rqf8-2568-r7mc 2026-10-03 medium | Manager-with-no-collections can enumerate org user/group → collection mappings (incomplete | rust:vaultwarden | <= 1.36.0 -> 1.37.0
|
||||
GHSA-hw4g-2v3f-74x5 2026-10-03 medium | Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs | rust:vaultwarden | <= 1.36.0 -> 1.37.0
|
||||
GHSA-72vh-x5jq-m82g 2026-05-19 medium | Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypass | :vaultwarden | <1.35.8 -> 1.36.0
|
||||
GHSA-c5rv-q295-7w4g 2026-04-25 high | Brute-force protection bypass vulnerability | :vaultwarden | <1.35.4 -> 1.35.4
|
||||
GHSA-937x-3j8m-7w7p 2026-04-25 high | Unconfirmed Owner Can Purge Entire Organization Vault | rust:vaultwarden | <=1.35.4 -> 1.35.5
|
||||
GHSA-569v-845w-g82p 2026-04-25 high | Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organizati | rust:vaultwarden | <=1.35.4 -> 1.35.5
|
||||
GHSA-6x5c-84vm-5j56 2026-05-19 high | SSO Email Auto-Link Can Bind an Existing Local Account to an Attacker-Controlled IdP Ident | :vaultwarden | <=1.35.8 -> 1.36.0
|
||||
GHSA-6j4w-g4jh-xjfx 2026-04-25 medium | Refresh tokens not invalidated on security stamp rotation | rust:Vaultwarden | <= 1.35.4 -> 1.35.5
|
||||
GHSA-hxqh-ff5p-wfr3 2026-05-19 medium | Authentication Flow Information Disclosure in SSO Discovery Allows Organization Enumeratio | :vaultwarden | <1.35.8 -> 1.36.0
|
||||
GHSA-x7g7-cgx5-jhx2 2026-04-25 medium | Vaultwarden: WebAuthn assertion processed before signature verification allows persistent | rust:vaultwarden | <= 1.35.4 -> 1.35.5
|
||||
GHSA-jjxg-p3v6-52ww 2026-04-26 medium | Missing authorization check in /organizations/{org_id}/collections/details allows Manager- | :vaultwarden | 1.35.4 -> 1.35.5
|
||||
GHSA-pfp2-jhgq-6hg5 2026-05-19 high | CSRF in SSO Authorization Flow | :vaultwarden | <1.35.8 -> 1.36.0
|
||||
GHSA-w9f8-m526-h7fh 2026-03-04 medium | Unauthorized Access via Partial Update API on Another User’s Cipher | rust:vaultwarden | 1.35.3 -> 1.35.4
|
||||
GHSA-h4hq-rgvh-wh27 2026-03-04 high | Collection Management Operations Allowed Without `manage` Verification for Manager Role | rust:vaultwarden | 1.35.3 -> 1.35.4
|
||||
GHSA-r32r-j5jq-3w4m 2026-03-04 high | Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager | rust:vaultwarden | 1.35.3 -> 1.35.4
|
||||
GHSA-h265-g7rm-h337 2026-02-11 medium | Full Cipher Enumeration Ignoring Organization Collection Permissions | :vaultwarden | <= 1.35.2 -> 1.35.3
|
||||
GHSA-v6pg-v89r-w8wr 2026-03-04 medium | 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement | :Vaultwarden | 1.34.3 -> 1.35.0
|
||||
GHSA-f7r5-w49x-gxm3 2025-01-25 high | Getting access to the Admin Panel via CSRF | docker hub:vaultwarden/server | <=1.32.7 -> 1.33.0
|
||||
GHSA-h6cc-rc6q-23j4 2025-01-25 high | RCE in the admin panel | docker hub:vaultwarden/server | <=1.32.7 -> 1.33.0
|
||||
GHSA-j4h8-vch3-f797 2025-01-25 high | Escalation of privilege via variable confusion in OrgHeaders trait | docker hub:vaultwarden/server | <=1.32.7 -> 1.33.0
|
||||
GHSA-g65h-982x-4m5m 2024-12-20 high | Privilege escalation allows organization groups to be updated/deleted if their UUID is kno | docker hub:vaultwarden/server | <1.32.6 -> 1.32.7
|
||||
@@ -0,0 +1,19 @@
|
||||
GHSA-q89f-h332-8q2h 2026-09-28 high | Authenticated SVG upload reaches ImageMagick coders and enables RCE | docker:ghcr.io/immich-app/immich-server | v3.2.2 -> v3.2.4
|
||||
GHSA-h5w4-vjv4-9r5q 2026-08-23 low | Incorrect sanitization of continue URL on the /maintenance endpoint | :immich-server | <= v3.1.0 -> None
|
||||
GHSA-g4w3-c888-cr93 2026-10-19 low | A regular user can create SharedLink for album/asset belonging to another user through Cre | : | <=3.1.0 -> v3.2.0
|
||||
GHSA-g82p-27g4-864h 2026-10-13 medium | Broken access control: GET /api/admin/users/{id}/calendar-heatmap is reachable by any auth | other:immich | >= 3.0.0, <= 3.0.3 ->
|
||||
GHSA-72rm-x7xr-v679 2026-10-19 medium | Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) i | other:immich | <= 3.0.3 -> v3.3.0
|
||||
GHSA-3mh5-gqfm-phgj 2026-10-19 medium | Cross-user disclosure of a user's Locked (hidden-vault) assets to a partner via timeline-b | other:immich (immich-app/immich) — server | <= 3.0.3 -> v3.1.0
|
||||
GHSA-qp2h-w794-2vhf 2026-07-06 medium | Incomplete fix for login continue redirect allows slash-backslash open redirect | other:immich-app/immich | <= 2.7.5, and current main e2de8c7c536cac5a673a3aa60cc998815b62d247 after PR #28706 -> v3.0.0
|
||||
GHSA-hv27-723h-qfjq 2026-10-19 medium | Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets via GET | immich-server:immich-server | <= v2.7.5 (current release) -> v3.0.0
|
||||
GHSA-c9mf-h82r-8p4j 2026-10-19 high | Album Editor can escalate to Owner role and remove Owner-role members via unguarded API en | npm:immich | <= 3.0.0 -> v3.0.3
|
||||
GHSA-8244-8vpr-vp9c 2026-06-01 critical | One-click account takeover via XSS in login page continue redirect | docker:immich-server | > main@4ffa26c9 -> > main@4eb1003
|
||||
GHSA-hfvf-5c8x-8rc4 2026-07-06 medium | OIDC discovery/token/userinfo/JWKS fetches run with TLS certificate verification unconditi | npm:@immich/server | <=latest -> v3.0.0
|
||||
GHSA-24fq-72x8-v7hm 2026-04-13 medium | Open Redirect via Shared Album name | docker:immich-server | < 2.7.3 -> >= 2.7.3
|
||||
GHSA-jrp5-g662-hq92 2026-07-06 low | Unsafe ZIP Entry Names (Zip Slip Class) in Archive Download Endpoint | npm:immich | >2.6.2 -> 3.0.0
|
||||
GHSA-9qx4-67jm-cc66 2026-04-08 high | Stored XSS via OCR Text in 360° Panorama Viewer | docker:immich-server | 2.6.x -> 2.7.0
|
||||
GHSA-hq46-gw2v-q86p 2026-07-06 medium | SSRF via OAuth Profile Picture URL (CWE-918) | npm:@immich/server | <= 1.129.0 -> v3.0.0
|
||||
GHSA-237r-x578-h5mv 2026-01-29 high | API Key Privilege Escalation | docker:immich-server | < 2.4.1 -> >= 2.5.0
|
||||
GHSA-hvq7-hq9r-8gjr 2026-07-06 medium | [DCODX-AI] Shared-link authentication allows adding owner's assets to shared links (AssetS | : | <=2.1.0 -> v3.0.0
|
||||
GHSA-78x4-6x83-jx75 2026-04-02 medium | Insecure transmission of shared link password | docker:immich-server | < v2.5.2 -> >= 2.6.0
|
||||
GHSA-3832-6r8h-9cfm 2025-07-11 high | Account hijacking through oauth2 | docker:immich-server | < v1.132.0 -> >= v1.132.0
|
||||
Whitespace-only changes.
@@ -0,0 +1,89 @@
|
||||
GHSA-hrpp-p4fc-wwf8 2026-10-21 high | ForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity | go:github.com/traefik/traefik/v2 | <= v2.11.59 -> v2.11.60 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.7.15 -> v3.7.16
|
||||
GHSA-p8wx-ph99-xgcr 2026-10-16 high | ingress-nginx provider: mTLS (auth-tls-secret) silently disabled for a host when another I | go:github.com/traefik/traefik/v3 | >= v3.7.0-ea.1, <= v3.7.14 -> v3.7.15
|
||||
GHSA-fh26-gfpp-7xxx 2026-10-07 high | snicheck skips the check when `req.TLS` is nil (HTTP/2 `:scheme http`) | go:github.com/traefik/traefik/v2 | <= v2.11.57 -> v2.11.58 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.7.13 -> v3.7.14
|
||||
GHSA-qvj7-gq9c-hp7q 2026-10-07 high | Kubernetes Ingress NGINX provider: ssl-passthrough sibling HTTP router serves the auth-pro | go:github.com/traefik/traefik/v3 | >= v3.7.13, <= v3.7.13 -> v3.7.14
|
||||
GHSA-53qr-784g-cj35 2026-10-07 high | FastProxy backend connection pool leaks connection-bound NTLM/Negotiate identity to unauth | go:github.com/traefik/traefik/v3 | >= v3.2.0, <= v3.7.13 -> v3.7.14
|
||||
GHSA-rv2h-qh7j-xrjw 2026-10-07 high | Ingress-NGINX provider: colliding auth-tls-secret names merge two client CAs into one TLS | go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.13 -> v3.7.14
|
||||
GHSA-qm9f-w54v-q2qh 2026-10-07 high | Preauthenticated Negotiate contaminates Traefik's globally shared backend connection pool | go:github.com/traefik/traefik/v2 | >= v2.11.0, <= v2.11.57 -> v2.11.58 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.7.13 -> v3.7.14
|
||||
GHSA-mwrr-6hp4-pxr6 2026-10-07 high | Ingress-NGINX provider forwards forged Ssl-Client-* identity headers on its HTTP route | go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.13 -> v3.7.14
|
||||
GHSA-28hp-c82p-8vqj 2026-10-16 low | Kubernetes Ingress NGINX provider: a TLS-option cache hit skips the cross-namespace author | go:github.com/traefik/traefik/v3 | >= v3.7.11, <= v3.7.14 -> v3.7.15
|
||||
GHSA-v67p-phpq-fc8x 2026-09-07 high | Traefik entrypoint header-name sanitization bypassed via request trailers | go:github.com/traefik/traefik/v3 | >= v3.2.0, <= v3.7.12 -> v3.7.13
|
||||
GHSA-qqjf-53cj-pwvv 2026-09-07 critical | Traefik HTTP/3 Backend NTLM Connection Reuse | go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.7.12 -> v3.7.13 ; go:github.com/traefik/traefik/v2 | >= v2.11.0, <= v2.11.56 -> v2.11.57
|
||||
GHSA-ww7c-q3mv-xx22 2026-10-16 high | Data race on the shared bufio.Reader after an HTTP/1 upgrade in FastProxy panics the whole | go:github.com/traefik/traefik/v3 | >= v3.2.0, <= v3.7.14 -> v3.7.15
|
||||
GHSA-mhjw-hmjv-p99x 2026-10-07 medium | Unsynchronized write to the per-connection sticky round tripper shared by concurrent HTTP/ | go:github.com/traefik/traefik/v2 | >= v2.11.0, <= v2.11.57 -> v2.11.58 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.7.13 -> v3.7.14
|
||||
GHSA-cw35-4q88-3rmp 2026-10-07 high | Connection-scoped NTLM/Kerberos sticky round tripper is not keyed by service, applying one | go:github.com/traefik/traefik/v2 | >= v2.11.0, <= v2.11.57 -> v2.11.58 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.7.13 -> v3.7.14
|
||||
GHSA-2272-4vv8-65ww 2026-10-07 medium | Negated Host matcher causes a TLS option conflict that disables client-certificate authent | go:github.com/traefik/traefik/v2 | <= v2.11.57 -> v2.11.58 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.7.12 -> v3.7.13
|
||||
GHSA-8fcf-v89g-xpg6 2026-09-07 medium | BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration tim | go:github.com/traefik/traefik/v3 | >= v3.6.11, <= v3.7.12 -> v3.7.13
|
||||
GHSA-f52w-8j3h-j724 2026-09-07 high | Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-sco | go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.7.12 -> v3.7.13 ; go:github.com/traefik/traefik/v2 | <= v2.11.56 -> v2.11.57
|
||||
GHSA-w4v4-9rw7-5326 2026-09-07 high | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incor | go:github.com/traefik/traefik/v3 | >= v3.4.2, <= v3.7.12 -> v3.7.13 ; go:github.com/traefik/traefik/v2 | >= v2.11.26, <= v2.11.56 -> v2.11.57
|
||||
GHSA-cjr6-pf59-jq29 2026-08-27 high | ingress-nginx from-to-www-redirect sibling router serves the auth-protected backend withou | go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.11 -> v3.7.12
|
||||
GHSA-7ghq-v6jf-g56c 2026-08-27 medium | respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbound | go:github.com/traefik/traefik/v2 | >= v2.8.2, <= v2.11.55 -> v2.11.56 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.7.11 -> v3.7.12
|
||||
GHSA-m6wx-622r-48r9 2026-08-21 high | Kubernetes Ingress service middleware bypasses crossProviderNamespaces | go:github.com/traefik/traefik/v3 | >= v3.7.1, <= v3.7.10 -> v3.7.11
|
||||
GHSA-rf44-j88r-hh8c 2026-08-27 medium | ForwardAuth identity spoofing via dot-form header alias | go:github.com/traefik/traefik/v2 | <= v2.11.55 -> v2.11.56 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.7.11 -> v3.7.12
|
||||
GHSA-5w68-77r2-r64c 2026-08-21 critical | Complete authentication bypass in the `digestAuth` middleware | go:github.com/traefik/traefik/v2 | <= v2.11.54 -> v2.11.55 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.7.10 -> v3.7.11
|
||||
GHSA-j994-9gqj-9hwq 2026-08-21 high | Same-host Ingress TLS option conflict disables client-certificate authentication | go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.10 -> v3.7.11
|
||||
GHSA-g55h-rg46-x9c5 2026-08-21 high | TLS option confusion in multi-host routers can bypass mTLS for protected hosts | go:github.com/traefik/traefik/v2 | <= v2.11.54 -> v2.11.55 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.7.10 -> v3.7.11
|
||||
GHSA-fgjj-px3w-67xx 2026-08-03 high | Gateway API route identity collision allows cross-namespace backend hijacking | go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.6.24 -> v3.6.25 ; go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.9 -> v3.7.10
|
||||
GHSA-6765-c87h-8mrf 2026-08-03 low | BasicAuth singleflight key collision allows authenticated identity spoofing | go:github.com/traefik/traefik/v3 | >= v3.6.11, <= v3.6.24 -> v3.6.25 ; go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.9 -> v3.7.10
|
||||
GHSA-62fc-8686-hfmq 2026-08-03 medium | `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef | go:github.com/traefik/traefik/v2 | <= v2.11.53 -> v2.11.54 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.6.24 -> v3.6.25 ; go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.9 -> v3.7.10
|
||||
GHSA-3ccp-42pg-hgv6 2026-07-27 high | Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive p | go:github.com/traefik/traefik/v2 | <= v2.11.52 -> v2.11.53 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.6.23 -> v3.6.24 ; go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.8 -> v3.7.9
|
||||
GHSA-8rxv-jg7p-wvg3 2026-07-16 high | Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication By | go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.7 -> v3.7.8
|
||||
GHSA-cxjq-mrr5-89rv 2026-07-09 high | Authentication Bypass via Path Traversal in ReplacePathRegex Middleware | go:github.com/traefik/traefik | <= v1.7.34 -> ; go:github.com/traefik/traefik/v2 | <= v2.11.51 -> v2.11.52 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.6.22 -> v3.6.23 ; go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.6 -> v3.7.7
|
||||
GHSA-qq9q-x9w4-chhj 2026-07-09 medium | Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion | go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.6 -> v3.7.7
|
||||
GHSA-42cj-m3vj-89wv 2026-07-09 medium | Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass | go:github.com/traefik/traefik/v3 | >= v3.6.17, <= v3.6.22 -> v3.6.23 ; go:github.com/traefik/traefik/v3 | >= v3.7.1, <= v3.7.6 -> v3.7.7
|
||||
GHSA-6p8f-p8j2-rqmv 2026-07-01 medium | Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Serv | go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.5 -> v3.7.6
|
||||
GHSA-3g6v-2r68-prfc 2026-06-11 medium | Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist t | go:github.com/traefik/traefik/v3 | >= v3.6.17, <= v3.6.20 -> v3.6.21 ; go:github.com/traefik/traefik/v3 | >= v3.7.1, <= v3.7.4 -> v3.7.5
|
||||
GHSA-4mr2-fg2p-w63c 2026-06-19 medium | Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails | go:github.com/traefik/traefik/v3 | >= v3.7.0-ea.1, <= v3.7.4 -> v3.7.5
|
||||
GHSA-3q9r-p662-5j8m 2026-07-01 medium | ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto whe | go:github.com/traefik/traefik | <= v1.7.34 -> ; go:github.com/traefik/traefik/v2 | <= v2.11.50 -> v2.11.51 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.6.21 -> v3.6.22 ; go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.5 -> v3.7.6
|
||||
GHSA-x677-9fxg-v5c5 2026-07-01 high | Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-va | go:github.com/traefik/traefik/v2 | <= v2.11.50 -> v2.11.51 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.6.21 -> v3.6.22 ; go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.5 -> v3.7.6
|
||||
GHSA-xf64-8mw2-4gr2 2026-06-05 high | Traefik StripPrefix Route-Level Auth Bypass via Path Normalization | go:github.com/traefik/traefik/v2 | <= v2.11.46 -> v2.11.48 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.6.17 -> v3.6.19 ; go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.1 -> v3.7.3
|
||||
GHSA-5r4w-85f3-pw66 2026-06-05 high | SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass | go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.1 -> v3.7.3
|
||||
GHSA-9cr8-q42q-g8m7 2026-06-05 high | HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts | go:github.com/traefik/traefik/v2 | >= v2.5.0-rc1, <= v2.11.46 -> v2.11.48 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.6.17 -> v3.6.19 ; go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.1 -> v3.7.3
|
||||
GHSA-96qj-4jj5-wcjc 2026-05-11 medium | Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure o | go:github.com/traefik/traefik/v2 | <= v2.11.45 -> v2.11.46 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.6.16 -> v3.6.17 ; go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.0 -> v3.7.1
|
||||
GHSA-xhjw-95fp-8vgq 2026-04-24 medium | Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding | go:github.com/traefik/traefik/v2 | <= v2.11.42 -> v2.11.43 ; go:github.com/traefik/traefik/v3 | <= v3.6.13 -> v3.6.14 ; go:github.com/traefik/traefik/v3 | >= v3.7.0-ea.1, <= v3.7.0-rc.1 -> v3.7.0-rc.2
|
||||
GHSA-p6hg-qh38-555r 2026-05-04 medium | Errors middleware forwards Authorization and Cookie headers to separate error page service | go:github.com/traefik/traefik/v2 | <= v2.11.43 -> v2.11.44 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.6.14 -> v3.6.15 ; go:github.com/traefik/traefik/v3 | >= v3.7.0-ea.1, <= v3.7.0-rc.2 -> v3.7.0-rc.3
|
||||
GHSA-6x2q-h3cr-8j2h 2026-04-24 medium | BasicAuth middleware: timing side-channel vulnerability | go:github.com/traefik/traefik/v2 | <= v2.11.42 -> v2.11.43 ; go:github.com/traefik/traefik/v3 | <= v3.6.13 -> v3.6.14 ; go:github.com/traefik/traefik/v3 | >= v3.7.0-ea.1, <= v3.7.0-rc.1 -> v3.7.0-rc.2
|
||||
GHSA-5m6w-wvh7-57vm 2026-04-24 high | Forwarded alias spoofing top pre-auth decision bypass | go:github.com/traefik/traefik | <= v1.7.34 -> ; go:github.com/traefik/traefik/v2 | <= v2.11.42 -> v2.11.43 ; go:github.com/traefik/traefik/v3 | <= v3.6.13 -> v3.6.14 ; go:github.com/traefik/traefik/v3 | >= v3.7.0-ea.1, <= v3.7.0-rc.1 -> v3.7.0-rc.2
|
||||
GHSA-6384-m2mw-rf54 2026-04-24 high | ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth | go:github.com/traefik/traefik | <= v1.7.34 -> ; go:github.com/traefik/traefik/v2 | <= v2.11.42 -> v2.11.43 ; go:github.com/traefik/traefik/v3 | <= v3.6.13 -> v3.6.14 ; go:github.com/traefik/traefik/v3 | >= v3.7.0-ea.1, <= v3.7.0-rc.1 -> v3.7.0-rc.2
|
||||
GHSA-6jwx-7vp4-9847 2026-04-24 high | StripPrefixRegex auth bypass via Path/RawPath desync | go:github.com/traefik/traefik | <= v1.7.34 -> ; go:github.com/traefik/traefik/v2 | <= v2.11.42 -> v2.11.43 ; go:github.com/traefik/traefik/v3 | <= v3.6.13 -> v3.6.14 ; go:github.com/traefik/traefik/v3 | >= v3.7.0-ea.1, <= v3.7.0-rc.1 -> v3.7.0-rc.2
|
||||
GHSA-46wh-3698-f2cx 2026-03-27 high | Fix CVE-2026-33186 | go:github.com/traefik/traefik/v2 | <= v2.11.41 -> v2.11.42 ; go:github.com/traefik/traefik/v3 | <= v3.6.11 -> v3.6.12 ; go:github.com/traefik/traefik/v3 | >= v3.7.0-ea.1, <= v3.7.0-ea.2 -> v3.7.0-ea.3
|
||||
GHSA-qr99-7898-vr7c 2026-03-27 medium | BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField | go:github.com/traefik/traefik | <= v1.7.34 -> ; go:github.com/traefik/traefik/v2 | <= v2.11.41 -> v2.11.42 ; go:github.com/traefik/traefik/v3 | <= v3.6.11 -> v3.6.12 ; go:github.com/traefik/traefik/v3 | >= v3.7.0-ea.1, <= v3.7.0-ea.2 -> v3.7.0-ea.3
|
||||
GHSA-67jx-r9pv-98rj 2026-03-27 medium | Ingress Rule Injection Allows Host Restriction Bypass in Traefik | go:github.com/traefik/traefik/v3 | <= v3.6.10 -> v3.6.11 ; go:github.com/traefik/traefik/v3 | >= v3.7.0-ea.1, <= v3.7.0-ea.1 -> v3.7.0-ea.2
|
||||
GHSA-wvvq-wgcr-9q48 2026-03-20 high | Potential mTLS Bypass via Fragmented TLS ClientHello Causing Pre-SNI Sniff Fallback to Def | go:github.com/traefik/traefik/v2 | <= v2.11.40 -> v2.11.41 ; go:github.com/traefik/traefik/v3 | <= v3.6.10 -> v3.6.11 ; go:github.com/traefik/traefik/v3 | >= v3.7.0-ea.1, <= v3.7.0-ea.1 -> v3.7.0-ea.2
|
||||
GHSA-g3hg-j4jv-cwfr 2026-03-20 medium | BasicAuth Middleware Timing Attack Allows Username Enumeration | go:github.com/traefik/traefik | <= v1.7.34 -> ; go:github.com/traefik/traefik/v2 | <= v2.11.40 -> v2.11.41 ; go:github.com/traefik/traefik/v3 | <= v3.6.10 -> v3.6.11 ; go:github.com/traefik/traefik/v3 | >= v3.7.0-ea.1, <= v3.7.0-ea.1 -> v3.7.0-ea.2
|
||||
GHSA-4hjq-9h5c-252j 2026-03-11 high | HTTP/2 frames can cause a running server to panic | go:github.com/traefik/traefik/v2 | <= v2.11.39 -> v2.11.40 ; go:github.com/traefik/traefik/v3 | <= v3.6.9 -> v3.6.10
|
||||
GHSA-8q2w-wr49-whqj 2026-03-11 medium | Kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values | go:github.com/traefik/traefik/v2 | >= v2.5.0-rc3, <= v2.11.54 -> v2.11.55 ; go:github.com/traefik/traefik/v3 | <= v3.6.9 -> v3.6.10
|
||||
GHSA-fw45-f5q2-2p4x 2026-03-04 medium | ForwardAuth Middleware Allows Unbounded Response Body, Causing Potential Denial of Service | go:github.com/traefik/traefik/v2 | <= v2.11.37 -> v2.11.38 ; go:github.com/traefik/traefik/v3 | <= v3.6.8 -> v3.6.9
|
||||
GHSA-xw98-5q62-jx94 2026-03-04 high | TLS Handshake Error Handling Allows Stalled Connections on TCP Routers | go:github.com/traefik/traefik/v2 | <= v2.11.37 -> v2.11.38 ; go:github.com/traefik/traefik/v3 | <= v3.6.8 -> v3.6.9
|
||||
GHSA-92mv-8f8w-wq52 2026-03-04 high | Case-Sensitive Bypass in Connection Header Allows Removal of X-Forwarded Headers | go:github.com/traefik/traefik/v2 | >= v2.11.9, <= v2.11.37 -> v2.11.38 ; go:github.com/traefik/traefik/v3 | >= v3.1.3, <= v3.6.8 -> v3.6.9
|
||||
GHSA-89p3-4642-cr2w 2026-02-12 high | TCP readTimeout bypass via STARTTLS on Postgres | go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.6.7 -> v3.6.8
|
||||
GHSA-gv8r-9rw9-9697 2026-02-20 high | TLS ClientAuth Bypass on HTTP/3 | go:github.com/traefik/traefik/v2 | <= v2.11.36 -> v2.11.37 ; go:github.com/traefik/traefik/v3 | <= v3.6.7 -> v3.6.8
|
||||
GHSA-cwjm-3f7h-9hwq 2026-01-15 medium | ACME TLS-ALPN fast path lacks timeouts and close on handshake stall | go:github.com/traefik/traefik/v2 | <= v2.11.34 -> v2.11.35 ; go:github.com/traefik/traefik/v3 | <= v3.6.6 -> v3.6.7
|
||||
GHSA-rh7m-2m44-x32f 2026-10-05 medium | Traefik: Kubernetes Ingress and Service annotations allow cross-namespace references to Mi | go:github.com/traefik/traefik/v2 | <= v2.11.45 -> v2.11.46 ; go:github.com/traefik/traefik/v3 | >= v3.0.0, <= v3.6.16 -> v3.6.17 ; go:github.com/traefik/traefik/v3 | >= v3.7.0, <= v3.7.0 -> v3.7.1
|
||||
GHSA-7vww-mvcr-x6vj 2025-12-08 medium | Inverted TLS Verification Logic in Kubernetes NGINX Provider | go:github.com/traefik/traefik/v3 | >= v3.5.0, <= v3.6.2 -> v3.6.3
|
||||
GHSA-gm3x-23wp-hc2c 2025-12-08 high | Path Normalization Bypass in Traefik Router + Middleware Rules | go:github.com/traefik/traefik | <= v1.7.34 -> ; go:github.com/traefik/traefik/v2 | <= v2.11.31 -> v2.11.32 ; go:github.com/traefik/traefik/v3 | <= v3.6.2 -> v3.6.3
|
||||
GHSA-q6gg-9f92-r9wg 2025-08-01 high | Path Traversal in WASM Client Plugin | go:github.com/traefik/traefik/v2 | <= v2.11.27 -> v2.11.28 ; go:github.com/traefik/traefik/v3 | <= v3.4.4 -> v3.4.5 ; go:github.com/traefik/traefik/v3 | >= v3.5.0-rc1, <= v3.5.0-rc2 -> v3.5.0
|
||||
GHSA-vrch-868g-9jx5 2025-05-28 low | Path traversal still possible using url encoding | go:github.com/traefik/traefik | <= v1.7.34 -> ; go:github.com/traefik/traefik/v2 | <= v2.11.24 -> v2.11.25 ; go:github.com/traefik/traefik/v3 | <= v3.4.0 -> v3.4.1
|
||||
GHSA-5423-jcjm-2gpv 2025-04-18 critical | Security Vulnerability: Go 1.23.x < 1.23.8 - HTTP Request Smuggling Vulnerability - 1.23.8 | go:The Go Programming Language | < 1.23.8 -> 1.23.8
|
||||
GHSA-3wqc-mwfx-672p 2025-04-18 high | Fix CVE-2025-22868 | go:golang.org/x/oauth2/jws | < v0.27.0 -> v0.27.0
|
||||
GHSA-6p68-w45g-48j7 2025-04-21 high | Path Matchers Vulnerability | go:github.com/traefik/traefik | <= v1.7.34 -> ; go:github.com/traefik/traefik/v2 | <= v2.11.22 -> v2.11.23 ; go:github.com/traefik/traefik/v3 | <= v3.3.5 -> v3.3.6 ; go:github.com/traefik/traefik/v3 | >= v3.4.0-rc1, <= v3.4.0-rc1 -> v3.4.0-rc2
|
||||
GHSA-hxr6-2p24-hf98 2024-12-17 medium | Fix CVE-2024-53259 | go:github.com/traefik/traefik/v2 | <= v2.11.14 -> v2.11.15 ; go:github.com/traefik/traefik/v3 | <= v3.2.1 -> v3.2.2
|
||||
GHSA-h924-8g65-j9wg 2024-11-29 low | X-Forwarded-Prefix Header allows for Open Redirect | go:github.com/traefik/traefik | <= v1.7.34 -> ; go:github.com/traefik/traefik/v2 | <= v2.11.13 -> v2.11.14 ; go:github.com/traefik/traefik/v3 | <= v3.2.0 -> v3.2.1
|
||||
GHSA-62c8-mh53-4cqv 2024-09-19 critical | HTTP client can remove the X-Forwarded headers | go:github.com/traefik/traefik | <= v1.7.34 -> ; go:github.com/traefik/traefik/v2 | <= v2.11.8 -> v2.11.9 ; go:github.com/traefik/traefik/v3 | <= v3.1.2 -> v3.1.3
|
||||
GHSA-gxrv-wf35-62w9 2024-07-04 high | Bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes | go:github.com/traefik/traefik/v2 | <= v2.11.5 -> v2.11.6 ; go:github.com/traefik/traefik/v3 | <= v3.0.3 -> v3.0.4 ; go:github.com/traefik/traefik/v3 | >= v3.1.0-rc1, <= v3.1.0-rc2 -> v3.1.0-rc3
|
||||
GHSA-rvj4-q8q5-8grf 2024-06-20 medium | ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability | go:github.com/traefik/traefik/v2 | <= v2.11.4 -> v2.11.5 ; go:github.com/traefik/traefik/v3 | <= v3.0.2 -> v3.0.3
|
||||
GHSA-7jmw-8259-q9jx 2024-06-11 medium | Unexpected behavior with IPv4-mapped IPv6 addresses | go:github.com/traefik/traefik/v2 | <= v2.11.3 -> v2.11.4 ; go:github.com/traefik/traefik/v3 | <= v3.0.1 -> v3.0.2
|
||||
GHSA-f7cq-5v43-8pwp 2024-05-23 medium | Malformed DNS message can cause infinite loop | go:github.com/traefik/traefik/v2 | <= v2.11.2 -> v2.11.3 ; go:github.com/traefik/traefik/v3 | <= v3.0.0 -> v3.0.1
|
||||
GHSA-7f4j-64p6-5h5v 2024-04-15 medium | Fix CVE-2023-45288 - HTTP/2 CONTINUATION flood in net/http | go:github.com/traefik/traefik | <= v1.7.34 -> ; go:github.com/traefik/traefik/v2 | <= v2.11.1 -> v2.11.2 ; go:github.com/traefik/traefik/v3 | <= v3.0.0-rc4 -> v3.0.0-rc5
|
||||
GHSA-4vwx-54mw-vqfw 2024-04-12 high | Possible DoS vulnerability with Content-length header | go:github.com/traefik/traefik | <= v1.7.34 -> ; go:github.com/traefik/traefik/v2 | <= v2.11.0 -> v2.11.2 ; go:github.com/traefik/traefik/v3 | <= v3.0.0-rc3 -> v3.0.0-rc5
|
||||
GHSA-8g85-whqh-cr2f 2023-12-04 medium | Potential DDoS whith ACME HTTPChallenge | go:github.com/traefik/traefik | <= v1.7.34 -> ; go:github.com/traefik/traefik/v2 | <= v2.10.5 -> v2.10.6 ; go:github.com/traefik/traefik/v3 | <= v3.0.0-beta4 -> v3.0.0-beta5
|
||||
GHSA-6fwg-jrfw-ff7p 2023-12-04 medium | Uses 100% CPU after request to with host `traefik-service` | go:github.com/traefik/traefik/v2 | <= v2.10.5 -> v2.10.6 ; go:github.com/traefik/traefik/v3 | <= v3.0.0-beta4 -> v3.0.0-beta5
|
||||
GHSA-fvhj-4qfh-q2hm 2023-12-04 low | Incorrect processing of fragment in the URL leads to Authorization Bypass | go:github.com/traefik/traefik | <= v1.7.34 -> ; go:github.com/traefik/traefik/v2 | <= v2.10.5 -> v2.10.6 ; go:github.com/traefik/traefik/v3 | <= v3.0.0-beta4 -> v3.0.0-beta5
|
||||
GHSA-7v4p-328v-8v5g 2023-10-12 medium | HTTP/2 request could cause a deny of service | go:Go | <=1.21.2, <=1.20.9 -> 1.21.3, 1.20.10 ; go:github.com/traefik/traefik/v2 | <= v2.10.4 -> v2.10.5 ; go:github.com/traefik/traefik/v3 | <= v3.0.0-beta3 -> v3.0.0-beta4
|
||||
GHSA-7hj9-rv74-5g92 2023-04-11 high | HTTP header parsing could cause a deny of service | go:github.com/traefik/traefik | <= v1.7.34 -> ; go:Go | 1.20.2 -> 1.20.3 ; go:github.com/traefik/traefik/v2 | <= v2.9.9 -> v2.9.10 ; go:github.com/traefik/traefik/v2 | >= v2.10.0-rc1, <= v2.10.0-rc1 -> v2.10.0-rc2
|
||||
GHSA-h2ph-vhm7-g4hp 2022-12-08 medium | Authorization header displayed in the debug logs | go:github.com/traefik/traefik/v2 | < 2.9.6 -> 2.9.6
|
||||
GHSA-468w-8x39-gj5v 2022-12-08 high | Routes exposed with an empty TLSOption | go:github.com/traefik/traefik/v2 | < 2.9.6 -> 2.9.6
|
||||
GHSA-c6hx-pjc3-7fqr 2022-10-10 high | HTTP/2 connections management could cause a deny of service | go:github.com/traefik/traefik | <= v1.7.34 -> ; go:github.com/traefik/traefik/v2 | < v2.8.8 -> v2.8.8 ; go:github.com/traefik/traefik/v2 | >= v2.9.0-rc1, < v2.9.0-rc5 -> v2.9.0-rc5
|
||||
GHSA-hrhx-6h34-j5hc 2022-02-16 high | Wrong TLS configuration choice | go:github.com/traefik/traefik/v2 | <2.6.1 -> 2.6.1
|
||||
GHSA-m697-4v8f-55qg 2021-08-03 low | Drop Headers via Malicious Connection Header | go:github.com/traefik/traefik/v2 | < v2.4.13 -> v2.4.13 ; go:github.com/traefik/traefik | <= v1.7.30 ->
|
||||
GHSA-6qq8-5wq3-86rp 2020-07-30 low | X-Forwarded-Prefix Header Validation Vulnerability | go:github.com/traefik/traefik/v2 | < v2.2.8 -> v2.2.8 ; go:github.com/traefik/traefik/v2 | >= v2.3.0-rc1, < v2.3.0-rc3 -> v2.3.0-rc3 ; go:github.com/traefik/traefik | < v1.7.26 -> v1.7.26
|
||||
@@ -231,12 +231,14 @@ stopping line that lies.
|
||||
| **R-1275** | Storage & devices | P4 | **An English household sees the drive names in Hungarian** on the install page (and wherever a storage label shows): „Belső tárhely — 52.0 GB free (default)”, „Külső tárhely (hdd_1)” (catalog sweep 2026-10-24, `audits/catalog-sweep-2026-10-24/navidrome/page-install-en.txt`). The label is stored once, in Hungarian, when the drive is found (`felhom-controller/controller/internal/settings/settings.go` `InferStorageLabel`); a household may rename it. | OPEN | — | Render a label that still equals the inferred default in the reader's language; a test per language | CC |
|
||||
| **R-1276** | Storage & devices | P4 | **„Remove with data” leaves the app's empty parent folder** (`<drive>/appdata/<app>`) when the template binds a subfolder: Grimmory, RomM, Paperless-ngx (catalog sweep 2026-10-24; 4 KB each; the bound folders were removed). Harmless (empty, not counted as old data), untidy for a household that browses the drive. | OPEN | — | Remove the parent when it is empty after the bound folders go; a test | CC |
|
||||
|
||||
## Security & access — 24 rows (P1 2, P2 3, P3 13, P4 6)
|
||||
## Security & access — 26 rows (P1 2, P2 4, P3 14, P4 6)
|
||||
|
||||
| ID | Category | Sev | What | State | Blocked on | Next action | Owner |
|
||||
|---|---|---|---|---|---|---|---|
|
||||
| **R-1241** | Security & access | P1 | **2026-10-24: the Felhom half is DONE** — hub 0.168.0 deployed (the tokens sealed; every copy leaving the volume is clean, the live file's old bytes accepted by the operator, R-975 closed), the hub volume out of the Longhorn backup (D40, R-1243 VERIFY), the two old plain copies deleted by the operator. **What stays here is the homelab half:** the open NFS export and Longhorn's login (the homelab session). **A hacked app pod on DooPlex can read the hub's nightly database copies — with every customer's unsealed Cloudflare, tunnel and git token (R-975) — through the Longhorn NFS export, and by a published file-handle escape the operator signing keys on the same disk: whoever breaks one homelab app can take over the boxes' tunnels and sign agent updates.** MEASURED 2026-10-23 (Plex2Shell impact audit, `audits/plex2shell-felhom-impact-2026-10-23/`): export `/mnt/5_hdd/backup/longhorn-pvc` rw, `no_root_squash`, `no_subtree_check`, a sub-directory of sda1, which also holds `/mnt/5_hdd/felhom.eu/felhom-op-*` (no passphrase, R-924); `secure` is void in pods (containerd sets `ip_unprivileged_port_start=0`; a uid-1000 probe with no capabilities bound port 700); the four `felhom-system` volumes have `encrypted=false`; Longhorn's API on :9500 answers any pod with no login (backups, targets, volumes). In the Plex2Shell window neither door was used — verdict NOT REACHED (nfsd accepted 0 new connections 10-10 → 10-23, positive control; no off-schedule Longhorn backup or volume). 2026-10-23 ~15:18Z, operator yes: the export was narrowed from `*` to `10.42.0.0/16` — the home network and the tailnet are closed, pods are not (Longhorn connects from its pod address). Not exercised: the escape itself (Tier-2 machine). | OPEN | the homelab session (DooPlex host + cluster); the operator (R-924) | Homelab: a NetworkPolicy so only `longhorn-system` reaches :2049/:111 and :9500, or the backup store on its own filesystem. Felhom: R-975 sealed in hub 0.168.0 (deploy pending); the hub's plain Longhorn copies → R-1243; a passphrase on the signing keys (R-924) | operator |
|
||||
| **R-1303** | Security & access | P2 | **Nobody watches the security notices of what we ship.** The box's own programs and the 65 catalog apps are checked only by the monthly re-test, by hand, and only for „a newer version exists"; Cloudflare's eMudhra notice (R-1300) reached us by mail. Building: a nightly CI watch (GitHub per-repo advisories, the Cloudflare blog feed and cloudflared's `VULN-` notes, OSV for the Go builders, release feeds, registry tags) — ADVISORY mails that night, BEHIND weekly, a source down two nights mails. Spike: `audits/security-watch-2026-10-26/SPIKE.md` | OPEN — filed 2026-10-26, building | the GitHub key (operator said yes 2026-10-26; secret `GH_ADVISORY_TOKEN`) for the full nightly read | build, live run, test mail | CC |
|
||||
| **R-1139** | Security & access | P2 | **Tester 2's break-glass root password was not rotated with the others (R-954, operator decision D1 = A, 2026-10-17): the box has been offline since 2026-10-04.** demo-hp, Tester 1 and demo-felhom were rotated and proven on 2026-10-17 (`audits/agent-allowlist-rotation-2026-10-17/P3/`). | OPEN — filed 2026-10-17 **2026-10-22: closes when Tester 2 is reinstalled (operator ruling 2026-10-22 14:11 — a fresh install sets and vaults a new console password).** | Tester 2 reporting again | When it reports: the installer's step 4b alone (`P3/rotate-step4b.sh` shape), then the vaulted value logs in (PVE API 200) and the old one is refused | CC |
|
||||
| **R-1304** | Security & access | P3 | **traefik v3.7.13 (our pin) is inside 12 advisories of October 2026, fixed in v3.7.14–v3.7.16** (GHSA-fh26-gfpp-7xxx snicheck, GHSA-hrpp-p4fc-wwf8 ForwardAuth pool, GHSA-53qr-784g-cj35 FastProxy, and nine on the Kubernetes ingress-nginx provider or NTLM/Negotiate backends). Triage from our config: docker + file providers only, no FastProxy, no per-router TLS options, no NTLM backend; ForwardAuth goes to the controller — none seem to apply. Found by the security-watch spike (R-1303). `audits/security-watch-2026-10-26/raw/repoadv-traefik_traefik.txt` | OPEN — filed 2026-10-26 | a controller release | raise `TraefikImage` to ≥ v3.7.16 in the next controller release from `main`, with the release notes read for breaking changes | CC |
|
||||
| **R-1042** | Security & access | P3 | **The boxes' Cloudflare keys cannot change zone settings, so Cloudflare's own „Always Use HTTPS” cannot be switched on.** Measured 2026-10-14 on all three zones (`audits/https-only-2026-10-14/``1A-1-zones-and-keys.txt`): each `cf_api_token` is valid and sees only its own zone, but GET/PATCH `settings/always_use_https`, `ssl`, `security_header` answer 403; the redirect and transform rule phases too. The https-only fix therefore lives on the box (decision 246). A second layer at Cloudflare needs „Zone Settings: Edit” (and, for headers, „Transform Rules”) added to each customer's key — the hub's zone-reach check stays. | **WAITING-ON-OPERATOR** — filed 2026-10-14 | a key permission only the operator can grant | Optional: widen each customer key, then switch „Always Use HTTPS” on per zone | operator |
|
||||
| **R-1242** | Security & access | P3 | **The demo NAS export `/mnt/5_hdd/felhom-data` → 192.168.0.162 (demo-felhom) is a sub-directory of DooPlex's sda1 with `no_subtree_check`, so a compromised demo-felhom host could walk the whole disk as uid 101000 and read every world-readable file there (the GPG secrets exports are 0644, every repo, the public keys).** Measured 2026-10-23 (`audits/plex2shell-felhom-impact-2026-10-23/` Part 1; `exportfs -v`: `all_squash,anonuid=101000`). 0600 files (the signing keys) stay out of reach. Not exercised. | OPEN | a DooPlex host change (fence) | Give the demo share its own filesystem, or `subtree_check`; or remove other-read from `/mnt/5_hdd/backup/secrets/exports` | operator |
|
||||
| **R-1104** | Security & access | P3 | **Check https-only on Tester 2 when it reports again.** R-1033 (plain http on every public name) is closed on the three boxes that report (35 names → 301, 2026-10-16). Tester 2 (`sajatfelhom.hu`) has been off since 2026-10-04 on controller 0.292.0; its addresses answer Cloudflare 530 (tunnel down), so nothing is served in plain http while it is off. When it comes back it takes the floor (≥ 0.312.0 carries the redirect). | OPEN — filed 2026-10-16 | Tester 2 reporting again | Run `scripts/https_only_check.py` with Tester 2 in it; close | CC |
|
||||
|
||||
Reference in new issue
Block a user