CVSS Score: 5.3 Published: 2026-08-05 Full Report: https://cvereports.com/reports/CVE-2026-65602
An authorization bypass vulnerability in Traefik allows low-privileged users within unauthorized Kubernetes namespaces to reference privileged file-provider TCP serversTransports via IngressRouteTCP resources, bypassing the crossProviderNamespaces constraint.
Traefik fails to validate the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport configurations, enabling cross-provider namespace bypass.
- CWE ID: CWE-863 (Incorrect Authorization)
- Attack Vector: Network (Remote)
- CVSS v4.0: 5.3 (Medium)
- Impact Type: Subsequent System Integrity and Confidentiality (High)
- Exploit Status: No public weaponized exploits or active exploitation reported
- Mitre ATT&CK Technique: T1068 (Exploitation for Privilege Escalation)
- Traefik reverse proxy deployments running within Kubernetes clusters using IngressRouteTCP CRDs.
- Traefik: >= 3.6.0, <= 3.6.22 (Fixed in:
3.6.23) - Traefik: >= 3.7.0, <= 3.7.6 (Fixed in:
3.7.7)
- Enforce explicit crossProviderNamespaces restrictions in static configurations.
- Perform periodic scans on custom resource definitions to identify unauthorized provider suffixes.
- Segregate administrative and untrusted workloads into isolated Kubernetes cluster deployments.
Remediation Steps:
- Identify the current active Traefik deployment version.
- Upgrade to Traefik v3.6.23 or v3.7.7 depending on the active branch.
- Verify the static configuration explicitly includes the crossProviderNamespaces list containing only trusted namespaces.
- Run the kubectl diagnostic command to audit active IngressRouteTCP resources.
- GHSA-42cj-m3vj-89wv: Traefik IngressRouteTCP ServersTransport Namespace Bypass
- Official Fix Commit
- Official Preparation Commit
- Official Release Information (v3.6.23)
- Official Release Information (v3.7.7)
- VulnCheck Security Advisory
Generated by CVEReports - Automated Vulnerability Intelligence