CVE-2026-71325
Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Traefik is an open-source edge router that makes publishing services a fun and easy experience. Prior to 2.11.54, 3.6.25, and 3.7.10, cross-namespace @kubernetescrd references are not rejected for TraefikService backend references resolved by the service resolver. A tenant confined by RBAC to a single namespace can therefore bind its own router to a TraefikService owned by another namespace and expose or reroute that namespace's backend, defeating the namespace isolation allowCrossNamespace=false is meant to enforce. This issue is fixed in version 2.11.54, 3.6.25, 3.7.10.
| CWE | CWE-653 CWE-863 |
| Vendor | traefik |
| Product | traefik |
| Published | Aug 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for traefik traefik
Be the first to know when new unknown vulnerabilities affecting traefik traefik are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
traefik / traefik
< 2.11.54 >= 3.0.0, < 3.6.25 >= 3.7.0, < 3.7.10
References
github.com: https://github.com/traefik/traefik/security/advisories/GHSA-62fc-8686-hfmq github.com: https://github.com/traefik/traefik/commit/65ebf4b47fbdc33e3856803a5844a404e094d52d github.com: https://github.com/traefik/traefik/releases/tag/v2.11.54 github.com: https://github.com/traefik/traefik/releases/tag/v3.6.25 github.com: https://github.com/traefik/traefik/releases/tag/v3.7.10