Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.4

HAProxy Kubernetes Ingress Controller: Config Snippets Can Expose Secret Token

CVE-2025-59303 · published 1 year ago
Summary

Users with minimal permissions can access a secret token when a specific feature is enabled. This can compromise the security of HAProxy Kubernetes Ingress Controller installations. Update to a fixed version to prevent unauthorized access.

Original advisory text
HAProxy Kubernetes Ingress Controller before 3.1.13, when the config-snippets feature flag is used, accepts config snippets from users with create/update permissions. This can result in obtaining a...
HAProxy Kubernetes Ingress Controller before 3.1.13, when the config-snippets feature flag is used, accepts config snippets from users with create/update permissions. This can result in obtaining an ingress token secret as a response. The fixed versions of HAProxy Enterprise Kubernetes Ingress Controller are 3.0.16-ee1, 1.11.13-ee1, and 1.9.15-ee1.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-791Incomplete Filtering of Special Elements
Timeline
Published8 Oct 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-59303 · NVD
Track software like this
Free during beta