Database/Container, Kubernetes & orchestration
HAProxy Kubernetes Ingress Controller: config snippets leak the ingress token secret
Impact
Where the config-snippets feature flag is enabled, a namespace tenant holding create/update on Ingress objects can submit a snippet whose response returns the controller's ingress token secret. That token is cluster-level ingress credential material, so the blast radius crosses the namespace boundary that a multi-tenant GPU cluster relies on to separate customers. The leak requires only the ordinary Ingress write permission a tenant is usually given, which is why this scores as a privilege boundary failure rather than a configuration mistake.
Who can reach it
Any authenticated Kubernetes user or service account with create/update on Ingress resources in a cluster where config-snippets is enabled.
What to do
Upgrade the community controller to 3.1.13 or later; HAProxy Enterprise fixes are 3.0.16-ee1, 1.11.13-ee1 and 1.9.15-ee1. Interim mitigation is to disable the config-snippets feature flag. Either path is a controller deployment rollout, not a node operation; rotate the ingress token afterwards if snippets were ever enabled with untrusted tenants.
References
Related entries
- KubeVirt: SSRF in the virt-api port-forward handler via attacker-influenced VMI status IPCVE-2026-13318 · KubeVirtMedium
- Traefik: A tenant with HTTPRoute creation rights exposes the REST provider handler, bypassing provider isolationCVE-2026-44774 · TraefikMedium
- Envoy Gateway: extension-managed backendRef skips ReferenceGrant checks across namespacesCVE-2026-53718 · Envoy Gateway (HTTPRoute custom backendRef, missing validateBackendNamespace)Medium
- Kubernetes (kube-apiserver): Any user who can create a Service with externalIPs (or patch LB status) intercepts clusterCVE-2020-8554 · Kubernetes (kube-apiserver)Medium
- Kubernetes (kube-controller-manager): Half-blind SSRF from the controller manager into the cloud metadata serviceCVE-2020-8555 · Kubernetes (kube-controller-manager)Medium
- containerd: Environment variables from an unrelated image leak into a container, exposing another tenant's secretsCVE-2021-21334 · containerdMedium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.