0Xvijay

The Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and passes it to state.Tunnel without verifying that the caller owns the active session. An attacker who obtains a valid active session ID through log leakage, cluster-internal channels, or the unauthenticated ArriveAsClient endpoint can attach a routed tunnel to that session and gain its network routing capabilities. UUID4 session IDs make cold brute force impractical.

The Traffic Manager gRPC API on port 8081 accepts unauthenticated callers from the cluster network. The `ArriveAsClient` function stores a caller-supplied `Namespace` relying solely on the `ManagesNamespace` manager watchlist check, and the `CreateIntercept` function allows targeting any managed namespace without verifying the session's Kubernetes RBAC (Role-Based Access Control), which is a method of regulating access to computer or network resources based on the roles of individual users. An attacker with network access to the manager from any pod can register in an arbitrary managed namespace, create service intercepts, and receive intercepted traffic to obtain the victim pod's container environment, including secrets, tokens, and API keys.

The HTTP handler fails to apply authorization wrappers to trace-funnel analytics endpoints. This allows unauthenticated attackers to submit arbitrary funnel definitions to retrieve trace analytics, including identifiers, durations, span counts, service topology, and error activity, without providing credentials.

In the NamespacedMutatingPolicy CEL compiler, the `generator` library is exposed to `matchConditions`, allowing a namespace-scoped policy to invoke the `generator.apply(namespace, resources)` function with an arbitrary target namespace. The validation process in `pkg/cel/policies/mpol/validate.go` only verifies that the policy compiles without enforcing namespace scope, and the `GenerateResources()` function in `pkg/cel/libs/context.go` fails to reject cross-namespace targets. A user with permissions to create `NamespacedMutatingPolicy` objects in a specific namespace can exploit this to force the admission controller, which operates with cluster-wide privileges, to create resources such as ConfigMaps, NetworkPolicies, Secrets, and RoleBindings in any other namespace. This can lead to unauthorized modification of protected namespaces (e.g., `kube-system`) and potential privilege escalation to cluster administrator levels.

On multi-tenant clusters using namespaces as trust boundaries, a tenant capable of creating a controller-owned workload can reference a FeatureFlagSource or InProcessConfiguration in a different namespace using the `openfeature.dev/featureflagsource` annotation with NAMESPACE/NAME syntax. This allows the cluster-scoped operator to read the external resource and expose `spec.envVars` literal values, `spec.httpSyncBearerToken`, sync URIs, and associated ConfigMaps within the tenant's workload.

Traefik, an HTTP reverse proxy and load balancer, is susceptible to an identity impersonation issue. When the `headerField` configuration option is used with a non-canonical HTTP header name (for example, `x-auth-user` instead of `X-Auth-User`), an authenticated attacker can inject a canonical version of that header. This allows the attacker to impersonate any identity to the backend service. The backend receives two header entries, with the attacker-injected canonical version being read first, overriding Traefik's non-canonical write. This issue affects the Basic and Digest authentication middlewares. The vulnerability occurs because Traefik writes the authenticated username using a non-canonical map key, creating a separate header entry instead of overwriting the attacker's canonical one.