CVE-2025-59303 | THREATINT

Description

HAProxy Kubernetes Ingress Controller before 3.1.13, when the config-snippets feature flag is used, accepts config snippets from users with create/update permissions. This can result in obtaining an ingress token secret as a response. The fixed versions of HAProxy Enterprise Kubernetes Ingress Controller are 3.0.16-ee1, 1.11.13-ee1, and 1.9.15-ee1.

PUBLISHED Reserved 2025-09-12 | Published 2025-10-08 | Updated 2025-10-08 | Assigner mitre

MEDIUM: 6.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Problem types

CWE-791 Incomplete Filtering of Special Elements

Product status

Default status

unaffected

Any version before 3.1.13

affected

References

haproxy.com/...oxy-kubernetes-ingress-controller-secret-leak

cve.org (CVE-2025-59303)

nvd.nist.gov (CVE-2025-59303)

Download JSON