CVE-2025-46810: Traefik2 Privilege Escalation Vulnerability

CVE-2025-46810 Overview

CVE-2025-46810 is a UNIX symbolic link (symlink) following vulnerability in the packaging of the traefik2 package on openSUSE Tumbleweed. The flaw allows a local attacker who already controls the traefik service account to escalate privileges to root. The weakness is classified under [CWE-61: UNIX Symbolic Link (Symlink) Following]. It affects openSUSE Tumbleweed traefik2 versions before 2.11.29. The vulnerability resides in the distribution packaging, not in the upstream Traefik proxy code.

Critical Impact
A compromised or malicious traefik user can plant a symlink that root-owned package operations follow, resulting in full root privilege escalation on the affected host.

Affected Products

openSUSE Tumbleweed traefik2 package versions prior to 2.11.29
Systems running the traefik service account under the affected packaging
Rolling-release openSUSE Tumbleweed installations with traefik2 installed

Discovery Timeline

2025-09-02 - CVE-2025-46810 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46810

Vulnerability Analysis

The issue lives in the openSUSE Tumbleweed traefik2 packaging scripts, not in upstream Traefik. During installation, upgrade, or service execution, root-privileged operations write to or modify files inside directories that the traefik user can control. Because those code paths do not safely resolve symbolic links, the traefik user can replace a legitimate file or directory with a symlink pointing to any location on the filesystem. The privileged process then follows the symlink and performs its write, chown, or chmod on a target chosen by the attacker. The result is an arbitrary write or ownership change executed as root.

Root Cause

The root cause is unsafe file handling in package post-install, service startup, or log-rotation logic. Operations running as root open, create, or change permissions on paths under directories owned by the traefik user without using symlink-safe primitives such as O_NOFOLLOW, openat2 with RESOLVE_NO_SYMLINKS, or equivalent checks. This falls squarely under [CWE-61].

Attack Vector

Exploitation requires local access as the traefik user, typically obtained after compromising the Traefik process or an application it exposes. The attacker replaces an expected file or directory under a traefik-owned path with a symlink to a sensitive root-owned target such as /etc/shadow, /etc/sudoers.d/, or a systemd unit file. When the packaged scripts or service perform their privileged operation, they follow the symlink and modify the attacker-chosen target. The attacker then leverages the resulting write or permission change to obtain a root shell. See the SUSE Bug Report #1245204 for vendor-side technical details.

Detection Methods for CVE-2025-46810

Indicators of Compromise

Symbolic links appearing under traefik-owned directories such as /var/log/traefik/, /var/lib/traefik/, or /etc/traefik/ that point outside those directories
Unexpected modifications to root-owned files like /etc/shadow, /etc/passwd, or files under /etc/sudoers.d/ following a traefik2 package operation or service restart
New or altered systemd unit files, cron entries, or SUID binaries created shortly after traefik service activity

Detection Strategies

Audit file writes performed by root where the resolved path differs from the intended path under /var/log/traefik/, /var/lib/traefik/, or /etc/traefik/
Monitor execve and openat syscalls originating from the traefik user that create symlinks targeting root-owned sensitive files
Compare installed traefik2 package version against the fixed version 2.11.29 on all Tumbleweed hosts

Monitoring Recommendations

Enable Linux audit rules on paths under /etc/traefik, /var/lib/traefik, and /var/log/traefik to log symlink, symlinkat, and rename syscalls by non-root users
Alert on any chown or chmod operations by root that resolve to targets outside expected Traefik directories
Track post-install script execution from rpm and zypper for anomalous file operations on hosts running traefik2

How to Mitigate CVE-2025-46810

Immediate Actions Required

Upgrade the traefik2 package on openSUSE Tumbleweed to version 2.11.29 or later using zypper update traefik2
Inventory all Tumbleweed systems running Traefik and confirm the installed package version
Review directories owned by the traefik user for pre-existing malicious symlinks before applying the patch

Patch Information

The vulnerability is resolved in openSUSE Tumbleweed traefik2 version 2.11.29. The fix corrects the packaging so that privileged file operations no longer follow attacker-controlled symbolic links under traefik-owned directories. Refer to the SUSE Bug Report #1245204 for the vendor tracking record.

Workarounds

Restrict access to the traefik service account and harden the Traefik configuration to prevent initial compromise of that user
Set restrictive permissions on /var/log/traefik, /var/lib/traefik, and /etc/traefik so only trusted processes can create files there
Temporarily disable the traefik2 service on affected hosts until the patched package can be installed

bash

# Configuration example: upgrade traefik2 and verify the installed version
sudo zypper refresh
sudo zypper update traefik2
rpm -q traefik2
# Expected output: traefik2-2.11.29 or later