{
  "affected": [],
  "aliases": [
    "CVE-2024-23446"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-07T04:15:07Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{space_id} indices. Users who are authorized to call this API may obtain unauthorized access to documents if their roles are configured with DLS or FLS against the aforementioned index.",
  "id": "GHSA-967w-7xjc-4wqj",
  "modified": "2024-02-07T06:35:21Z",
  "published": "2024-02-07T06:35:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23446"
    },
    {
      "type": "WEB",
      "url": "https://discuss.elastic.co/t/kibana-8-12-1-security-update-esa-2024-01/352686"
    },
    {
      "type": "WEB",
      "url": "https://www.elastic.co/community/security"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-3864"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-08-26T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. The prerequisite is a SUID binary that sets real UID equal to effective UID, and real GID equal to effective GID. The descendant will then have a dumpable value set to 1. As a result, if the descendant process crashes and core_pattern is set to a relative value, its core dump is stored in the current directory with uid:gid permissions. An unprivileged local user with eligible root SUID binary could use this flaw to place core dumps into root-owned directories, potentially resulting in escalation of privileges.",
  "id": "GHSA-9682-f2fr-3h46",
  "modified": "2022-09-02T00:01:10Z",
  "published": "2022-08-27T00:00:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3864"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2021-3864"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2015046"
    },
    {
      "type": "WEB",
      "url": "https://lore.kernel.org/all/20211221021744.864115-1-longman%40redhat.com"
    },
    {
      "type": "WEB",
      "url": "https://lore.kernel.org/all/20211221021744.864115-1-longman@redhat.com"
    },
    {
      "type": "WEB",
      "url": "https://lore.kernel.org/all/20211226150310.GA992%401wt.eu"
    },
    {
      "type": "WEB",
      "url": "https://lore.kernel.org/all/20211226150310.GA992@1wt.eu"
    },
    {
      "type": "WEB",
      "url": "https://lore.kernel.org/lkml/20211228170910.623156-1-wander%40redhat.com"
    },
    {
      "type": "WEB",
      "url": "https://lore.kernel.org/lkml/20211228170910.623156-1-wander@redhat.com"
    },
    {
      "type": "WEB",
      "url": "https://security-tracker.debian.org/tracker/CVE-2021-3864"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2021/10/20/2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-20260"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-88"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-17T17:15:10Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the application CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager could allow an authenticated, local attacker to gain escalated privileges. This vulnerability is due to improper processing of command line arguments to application scripts. An attacker could exploit this vulnerability by issuing a command on the CLI with malicious options. A successful exploit could allow the attacker to gain the escalated privileges of the root user on the underlying operating system.",
  "id": "GHSA-96c9-2v9p-9chw",
  "modified": "2024-01-17T18:31:38Z",
  "published": "2024-01-17T18:31:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20260"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-epnm-wkZJeyeq"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-3567"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-06-03T19:29:00Z",
    "severity": "HIGH"
  },
  "details": "In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard link a parent folder of a malicious binary to a folder with known \u0027safe\u0027 permissions. Under those circumstances osquery will load said malicious executable with SYSTEM permissions. The solution is to migrate installations to the \u0027Program Files\u0027 directory on Windows which restricts unprivileged write access. This issue affects osquery prior to v3.4.0.",
  "id": "GHSA-96gq-m97m-9ppg",
  "modified": "2024-04-04T00:51:06Z",
  "published": "2022-05-24T16:47:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3567"
    },
    {
      "type": "WEB",
      "url": "https://www.facebook.com/security/advisories/cve-2019-3567"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2016-0760"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2016-08-19T21:59:00Z",
    "severity": "HIGH"
  },
  "details": "Multiple incomplete blacklist vulnerabilities in Apache Sentry before 1.7.0 allow remote authenticated users to execute arbitrary code via the (1) reflect, (2) reflect2, or (3) java_method Hive builtin functions.",
  "id": "GHSA-96hh-jjvq-5j5w",
  "modified": "2022-05-17T03:50:27Z",
  "published": "2022-05-17T03:50:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0760"
    },
    {
      "type": "WEB",
      "url": "http://mail-archives.apache.org/mod_mbox/sentry-dev/201608.mbox/%3CCACMN7ixDqDyOZGLEvsMUVHBiJ6crq8zdy%2B2mNfRooNhnk7CJ1g%40mail.gmail.com%3E"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/92328"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/argoproj/argo-cd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.5.0"
            },
            {
              "last_affected": "1.8.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/argoproj/argo-cd/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/argoproj/argo-cd/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.2.0"
            },
            {
              "fixed": "2.2.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/argoproj/argo-cd/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.3.0"
            },
            {
              "fixed": "2.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-1025"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1220",
      "CWE-284",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-21T22:29:13Z",
    "nvd_published_at": "2022-07-12T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "# Impact\n\n## Impacts for versions starting with v1.0.0\nAll unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level.\n\nTo perform the following exploits, an authorized Argo CD user must have push access to an Application\u0027s source git or Helm repository or `sync` and `override` access to an Application. Once a user has that access, different exploitation levels are possible depending on their other RBAC privileges:\n\n1. If that user has `update` access to the Application, they can modify any resource on the Application\u0027s destination cluster. If the destination cluster is or can be made to be the same as the cluster hosting Argo CD, the user can escalate their Argo CD permissions to admin-level.\n2. If the user has `delete` access to the Application, they can delete any resource on the Application\u0027s destination cluster. (This exploit is possible starting with v0.8.0.)\n3. If the user has `get` access to the Application, they can view any resource on the Application\u0027s destination cluster (except for the contents of Secrets) and list [actions](https://argo-cd.readthedocs.io/en/stable/operator-manual/resource_actions/) available for that resource.\n4. If the user has `get` access to the Application, they can view the logs of any Pods on the Application\u0027s destination cluster.\n5. If the user has `action/{some action or *}` access on the Application, they can run an action for any resource (which supports the allowed action(s)) on the Application\u0027s destination cluster. (Some actions are available in Argo CD by default, and others may be configured by an Argo CD admin.)\n\nSee the [Argo CD RBAC documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#rbac-resources-and-actions) for an explanation of the privileges available in Argo CD.\n\n## Events exploit\nA related exploit is possible for a user with `get` access to an Application **even if they do not have access to the Application\u0027s source git or Helm repository or `sync` and `override` access to the Application**. The user can access any Event in the Application\u0027s destination cluster if they know the involved object\u0027s name, UID, and namespace.\n\n## Impacts for versions starting with v0.8.0\nThe same bug exists starting with v0.8.0, but only the following exploits were possible before v1.0.0:\n\n- The `delete exploit` (#\u20602 above).\n- The logs exploit (#\u20604 above).\n- The Events exploit described above.\n\n## Impacts for versions starting with v0.5.0\nThe same bug exists starting with v0.5.0 (when RBAC was implemented), but only the Events exploit described above was possible before v0.8.0.\n\nPatches\nA patch for this vulnerability has been released in the following Argo CD versions:\n\n- v2.3.2\n- v2.2.8\n- v2.1.14\n\n**Versions 2.0.x and earlier users**: See the changelog for links to upgrade instructions for your version. It is imperative to upgrade quickly, but some limited mitigations are described in the next section.\n\n**argo-helm chart users**: Argo CD users deploying v2.3.x with argo-helm can upgrade the chart to version 4.2.2. Argo CD 2.2 and 2.1 users can set the global.image.tag value to the latest in your current release series (v2.2.8, or v2.1.14). Since charts for the 2.2 and 2.1 series are no longer maintained, you will need to either leave the value override in place or upgrade to the 4.x chart series (and therefore to Argo CD 2.3).\n\n## Workarounds\nThe only certain way to avoid the vulnerability is to upgrade.\n\n## Mitigations\n\n- To avoid privilege escalation:\n    - Limit who has push access to Application source repositories or sync + override access to Applications.\n- Limit which repositories are available in projects where users have update access to Applications.\n    - To avoid unauthorized resource inspection/tampering:\n    - Limit who has delete, get, or action access to Applications.\n\nThese mitigations can help limit potential damage, but they are not a substitute for upgrading. It is necessary to upgrade immediately.",
  "id": "GHSA-96jv-vj39-x4j6",
  "modified": "2023-06-27T20:58:57Z",
  "published": "2022-07-13T00:00:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-2f5v-8r3f-8pww"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1025"
    },
    {
      "type": "WEB",
      "url": "https://github.com/argoproj/argo-cd/commit/af03b291d4b7e9d3ce9a6580ae9c8141af0e05cf"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2022:1039"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2022:1040"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2022:1041"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2022:1042"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2022-1025"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2064682"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/argoproj/argo-cd"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Argo CD improper access control bug can allow malicious user to escalate privileges to admin level"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-60871"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-21T22:18:24Z",
    "severity": "HIGH"
  },
  "details": "Vulnerability in the Oracle Risk Management product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Risk Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Risk Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Risk Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).",
  "id": "GHSA-96p6-r39h-34m7",
  "modified": "2026-07-22T00:32:04Z",
  "published": "2026-07-22T00:32:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60871"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.7.0"
            },
            {
              "fixed": "3.7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.7.0"
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.6.16"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.11.45"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.46"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.7.34"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44774"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-13T15:29:56Z",
    "nvd_published_at": "2026-05-15T17:16:48Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThere is a medium severity vulnerability in Traefik\u0027s Kubernetes Gateway API provider that allows a tenant with `HTTPRoute` creation permissions to expose the REST provider handler, bypassing the `providers.rest.insecure=false` setting. The Gateway provider accepts any `TraefikService` backend reference whose name ends with `@internal`, making it possible to route traffic to `rest@internal` in addition to the intended `api@internal`. In shared Gateway deployments where the REST provider is enabled, this allows a low-privileged actor to gain live dynamic configuration write access to Traefik, enabling unauthorized reconfiguration of routers and services.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.46\n- https://github.com/traefik/traefik/releases/tag/v3.6.17\n- https://github.com/traefik/traefik/releases/tag/v3.7.1\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n\u003cdetails\u003e\n\u003csummary\u003eOriginal Description\u003c/summary\u003e\n\n### Summary\nWhen the Kubernetes Gateway API provider is enabled, Traefik accepts any `TraefikService` backend whose name ends with `@internal`. This allows a tenant-controlled `HTTPRoute` to publish `rest@internal`.\n\nIf `providers.rest` is enabled, this exposes Traefik\u0027s REST provider handler even when `providers.rest.insecure=false`, even though providers.rest.insecure=false is meant to keep the REST handler from being exposed by Traefik\u0027s built-in internal router. In a shared Gateway deployment, an actor with permission to create or update `HTTPRoute` resources in an allowed namespace can gain live Traefik dynamic-configuration write access through `PUT /api/providers/rest`.\n\n### Details\nThe Gateway provider treats internal services broadly rather than allowing only a specific internal target.\n\nIn current `master`, `pkg/provider/kubernetes/gateway/kubernetes.go` defines `isInternalService(...)` as any `TraefikService` reference whose name ends with `@internal`.\n\nThen `pkg/provider/kubernetes/gateway/httproute.go` special-cases a single backend reference that matches `isInternalService(...)` and directly assigns `router.Service = string(routeRule.BackendRefs[0].Name)`.\n\nThis means a tenant route can target not only `api@internal`, but also `rest@internal` and other internal handlers.\n\nSeparately, the REST provider handler is created whenever the REST provider is enabled. In `pkg/server/service/managerfactory.go`, if `staticConfiguration.Providers.Rest != nil`, Traefik sets `factory.restHandler = staticConfiguration.Providers.Rest.CreateRouter()`.\n\nThe REST provider handler itself is implemented in `pkg/provider/rest/rest.go` and accepts `PUT /api/providers/{provider}`.\n\nThe `providers.rest.insecure` flag does not disable the underlying handler. In `pkg/provider/traefik/internal.go`, that flag only controls whether Traefik creates its own built-in internal router for `rest@internal`. Even when `providers.rest.insecure=false`, Traefik still registers the `rest` service object, and the service layer can still resolve `rest@internal` if another provider routes to it.\n\nI validated this locally in two tests:\n1. the Gateway route-building path accepts `rest@internal` as an internal backend through the same special-case branch used for `api@internal`\n2. the service layer builds and serves `rest@internal` successfully when `providers.rest` is enabled and `providers.rest.insecure=false`\n\nThe vulnerable code path is present in:\n- `v3.0.0`\n- `v3.6.7`\n- `v2.11.0`\n- `v2.11.36`\n- current `master` at `786f7192e11878dfaa634f8263bf79bb730a71cb`\n\nI verified the issue in v3.0.0, v3.6.7, v2.11.0, v2.11.36, and current master; the reported affected ranges reflect the maintained release lines checked during validation\n\nI did not find a public Traefik advisory or CVE for this exact issue. The closest public overlap I found is the documented/tested Gateway support for `api@internal`, but the issue here is broader because the Gateway code accepts any `@internal` `TraefikService`, including the write-capable `rest@internal` handler.\n\n### Expected behavior\n`providers.rest.insecure=false` should prevent low-privileged route authors from exposing the REST provider handler.\n\n### Actual behavior\nA tenant-controlled Gateway route can still publish `rest@internal` and reach the REST update API.\n\n### Attacker prerequisites\n- The Kubernetes Gateway API provider is enabled.\n- `providers.rest=true`.\n- `providers.rest.insecure=false`.\n- A shared Gateway allows tenant namespaces to attach `HTTPRoute` resources.\n- The attacker can create or update `HTTPRoute` resources in an allowed tenant namespace.\n\n### PoC\n1. Configure Traefik so that the Kubernetes Gateway provider is enabled, the REST provider is enabled, and the REST provider is not exposed insecurely.\n\nExample static configuration:\n\n```yaml\nproviders:\n  kubernetesGateway: {}\n  rest:\n    insecure: false\n```\n\n2. Ensure a shared Gateway allows tenant `HTTPRoute` attachment.\n\n3. In an allowed tenant namespace, create an `HTTPRoute` whose backend points to `rest@internal`:\n\n```yaml\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n  name: expose-rest-internal\n  namespace: tenant-a\nspec:\n  parentRefs:\n    - name: shared-gateway\n      namespace: infra\n  hostnames:\n    - rest.tenant.example\n  rules:\n    - matches:\n        - path:\n            type: PathPrefix\n            value: /\n      backendRefs:\n        - group: traefik.io\n          kind: TraefikService\n          name: rest@internal\n          port: 80\n```\n\n4. Send a `PUT` request through that published route to `/api/providers/rest` with a valid dynamic configuration body. A harmless proof can add a dummy router pointing to `noop@internal`.\n\nExample request body:\n\n```json\n{\n  \"http\": {\n    \"routers\": {\n      \"probe\": {\n        \"rule\": \"PathPrefix(`/probe`)\",\n        \"service\": \"noop@internal\",\n        \"ruleSyntax\": \"default\"\n      }\n    }\n  }\n}\n```\n\n5. Observe that Traefik accepts the update and applies the supplied dynamic configuration, even though `providers.rest.insecure=false`.\n\n### Impact\nThis is an authorization / trust-boundary bypass affecting shared Gateway deployments.\n\nOn affected deployments, an actor who should only be able to create or update `HTTPRoute` objects can escalate to live Traefik dynamic-configuration write access. That can allow unauthorized reconfiguration of routers and services, publication of additional internal surfaces, request interception or rerouting, and denial of service through destructive config changes.\n\nOn affected deployments, this gives a low-privileged Gateway route author live Traefik dynamic-configuration write access. This is critical for affected shared Gateway deployments because it can give a low-privileged route author live Traefik dynamic-configuration write access, but it depends on providers.rest being enabled.\n\nThis is not an unauthenticated vulnerability in all Traefik deployments. The issue depends on realistic but specific conditions:\n- `providers.rest` must be enabled\n- the attacker must be allowed to attach `HTTPRoute` resources to a shared Gateway\n\n\u003c/details\u003e",
  "id": "GHSA-96qj-4jj5-wcjc",
  "modified": "2026-05-15T23:50:03Z",
  "published": "2026-05-13T15:29:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-96qj-4jj5-wcjc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44774"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/traefik/traefik"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v2.11.46"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v3.6.17"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v3.7.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false"
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-1695"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-05-03T15:29:00Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the detection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, adjacent attacker to send data directly to the kernel of an affected device. The vulnerability exists because the software improperly filters Ethernet frames sent to an affected device. An attacker could exploit this vulnerability by sending crafted packets to the management interface of an affected device. A successful exploit could allow the attacker to bypass the Layer 2 (L2) filters and send data directly to the kernel of the affected device. A malicious frame successfully delivered would make the target device generate a specific syslog entry.",
  "id": "GHSA-96r8-3qv9-q756",
  "modified": "2023-08-15T15:30:46Z",
  "published": "2022-05-24T16:45:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1695"
    },
    {
      "type": "WEB",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-asa-ftd-bypass"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/108173"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "drupal/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0"
            },
            {
              "fixed": "7.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2011-2687"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-19T17:29:45Z",
    "nvd_published_at": "2011-07-27T02:55:00Z",
    "severity": "HIGH"
  },
  "details": "Drupal 7.x before 7.3 allows remote attackers to bypass intended `node_access` restrictions via vectors related to a listing that shows nodes but lacks a JOIN clause for the node table.",
  "id": "GHSA-96vx-qf28-6f8m",
  "modified": "2024-01-19T17:29:45Z",
  "published": "2022-05-17T04:08:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2687"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=717874"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20110710024036/http://www.securityfocus.com/bid/48505"
    },
    {
      "type": "WEB",
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=633385"
    },
    {
      "type": "WEB",
      "url": "http://drupal.org/node/1204582"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062714.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062722.html"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2011/07/11/2"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2011/07/12/16"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Drupal Access Control Bypass"
}