CVE-2025-59303

A flaw was found in HAProxy Kubernetes Ingress Controller. This vulnerability allows an authenticated attacker to obtain an ingress token secret by submitting malicious configuration snippets when the config-snippets feature is enabled.

This flaw is rated MODERATE primarily because successful exploitation requires the attacker to possess existing privileges allowing them to create or modify Ingress or Service objects in a cluster environment. The core flaw is a configuration injection weakness where the KIC's config-snippets feature can be misused to embed arbitrary HAProxy directives that are not properly sanitized. This malicious code allows an attacker to access environment variables, specifically the highly sensitive Kubernetes service account token secret, which is available to the ingress controller pod. Obtaining this token permits an authenticated user to perform privilege escalation and access cluster data. So essentially, for a product to be affected, it has to both ship the base haproxy RPM and run it in the Kubernetes Ingres Controller.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disabling the config-snippets feature before starting the Ingres Controller is a useful mitigation for this vulnerability. This can be done by starting the Ingres Controller with the following flag: --disable-config-snippets

Upgrade to version 3.2 and above to fix this issue.