CVE-2022-27518_POC

CVE-2022-27518POC docker pull quay.io/citrix/citrix-k8s-cpx-ingress:13.0-58.30 Use the following command to verify if CPX image is installed in docker images docker images | grep 'citrix-k8s-cpx-ingress' Use the following command to create a CPX container instance running in bridge mode docker ru...

nginx-patch

nginx 1.15.x base image using debian-base nginx engine x is an HTTP and reverse proxy server, a mail proxy server, and a generic TCP proxy server. This custom nginx image contains: ngxdevelkit set-misc-nginx-module headers-more-nginx-module nginx-http-auth-digest ngxhttpsubstitutionsfiltermodule...

IngressNightmare-POCs

IngressNightmare-POCs CVE-2025-24513: https://github.com/kubernetes/kubernetes/issues/131005 CVE-2025-24514: https://github.com/kubernetes/kubernetes/issues/131006 CVE-2025-1097: https://github.com/kubernetes/kubernetes/issues/131007 CVE-2025-1098:...

IngressNightterror

IngressNightterror CVE-2025-1974 Overview This repository is my research on IngressNightmare vulnerability. It includes a vulnerable Ingress deploy files, exploit itself and shared object payload. CVE The list of CVE indexes: CVE-2025-1974 - Root vulnerability CVE-2025-24514 - auth-url annotation...

CVE-2026-85594

A flaw was found in Traefik. The software fails to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation within the Kubernetes Ingress provider. This vulnerability allows a namespace-limited tenant, even if excluded from the...

CVE-2026-85596

A flaw was found in Traefik. This vulnerability allows a remote attacker to bypass authentication, gaining unauthorized access to protected routes. This occurs due to a conflict in how Traefik handles Transport Layer Security TLS options when specific Kubernetes Ingress objects are configured. Th...

CVE-2026-67309

A flaw was found in Traefik. This path traversal vulnerability exists in the Kubernetes Ingress NGINX provider's RewriteTarget middleware. A remote attacker can craft a special request that uses dot-segment traversal to bypass authentication mechanisms like BasicAuth, DigestAuth, or ForwardAuth...

EUVD-2026-75427

Traefik is a HTTP reverse proxy and load balancer. In versions = v3.7.0 and = v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creat...

CVE-2026-88877 Traefik v3.7.0 Authentication Bypass via from-to-www-redirect

Traefik is a HTTP reverse proxy and load balancer. In versions = v3.7.0 and = v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creat...

CVE-2026-88877: Authorization Bypass Through User-Controlled Key

Traefik is a HTTP reverse proxy and load balancer. In versions = v3.7.0 and = v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creat...

SUSE CVE-2026-85594

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its...

SUSE CVE-2026-85596

Traefik versions = v3.7.0 and = v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress carrying the nginx.ingress.kubernetes.io/auth-tls-secret annotation was named after the Ingress namespace and name. As a result, two Ingress...

CVE-2026-85596

Traefik versions = v3.7.0 and = v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress carrying the nginx.ingress.kubernetes.io/auth-tls-secret annotation was named after the Ingress namespace and name. As a result, two Ingress...

CVE-2026-85594

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its...

EUVD-2026-71019

Traefik versions = v3.7.0 and = v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress carrying the nginx.ingress.kubernetes.io/auth-tls-secret annotation was named after the Ingress namespace and name. As a result, two Ingress...

CVE-2026-85594 Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its...

EUVD-2026-71017

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its...

CVE-2026-85594 Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its...

CVE-2026-85594 Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its...

CVE-2026-85594

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its S...