CVE-2025-59303
Description
A flaw was found in HAProxy Kubernetes Ingress Controller. This vulnerability allows an authenticated attacker to obtain an ingress token secret by submitting malicious configuration snippets when the config-snippets feature is enabled.
Statement
This flaw is rated MODERATE primarily because successful exploitation requires the attacker to possess existing privileges allowing them to create or modify Ingress or Service objects in a cluster environment. The core flaw is a configuration injection weakness where the KIC's config-snippets feature can be misused to embed arbitrary HAProxy directives that are not properly sanitized. This malicious code allows an attacker to access environment variables, specifically the highly sensitive Kubernetes service account token secret, which is available to the ingress controller pod. Obtaining this token permits an authenticated user to perform privilege escalation and access cluster data. So essentially, for a product to be affected, it has to both ship the base haproxy RPM and run it in the Kubernetes Ingres Controller.
Mitigation
Disabling the config-snippets feature before starting the Ingres Controller is a useful mitigation for this vulnerability.
This can be done by starting the Ingres Controller with the following flag:
--disable-config-snippets
Upgrade to version 3.2 and above to fix this issue.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.5 | N/A | 6.4 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Changed |
| Confidentiality | High | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Understanding the Weakness (CWE)
Integrity
Technical Impact: Unexpected State
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
