Create an APIService for an API group pointing at an attacker-controlled backend
Requests for that group are proxied with trusted X-Remote-User and X-Remote-Group identity headers.
Caller bearer tokens and TLS certificates are NOT forwarded to the backend
Observe or spoof responses for the claimed API group.
This gives data interception within that group, not a generic credential-theft primitive
Note:
CVE-2018-1002105 and CVE-2022-3172 are patched in all current versions.
The aggregated-APIService MITM path (X-Remote-User/Group headers forwarded to backend with caller identity) is a design property, not a CVE, and remains in all versions where aggregation is enabled.