CVE-2026-65602 in Traefik
Summary
by MITRE • 07/22/2026
Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references (the allowlist was only enforced for HTTP serversTransport references). A low-privileged Kubernetes user in a namespace not listed in crossProviderNamespaces can set serversTransport: foo@file on an IngressRouteTCP service, causing Traefik to accept the forbidden cross-provider reference and use a file-provider TCPServersTransport — including privileged backend mTLS client certificates, SPIFFE identity, or PROXY-protocol settings. This is fixed in 3.6.23 and 3.7.7.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability affects Traefik versions 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6, where the crossProviderNamespaces allowlist enforcement mechanism is inconsistently applied across different service transport configurations. The flaw represents a privilege escalation vulnerability that allows low-privileged Kubernetes users to bypass namespace restrictions and access resources that should be confined to specific namespaces.
The technical implementation of this vulnerability stems from an incomplete security check within Traefik's IngressRouteTCP processing logic. While the system correctly enforces the crossProviderNamespaces allowlist for HTTP serversTransport references, it fails to apply the same validation for TCP serversTransport references. This inconsistency creates a security gap where users can reference TCPServersTransport objects from file providers even when those references would be forbidden based on namespace restrictions.
The operational impact of this vulnerability is significant as it enables unauthorized access to privileged backend configurations. A malicious user can exploit this weakness by setting serversTransport: foo@file on an IngressRouteTCP service, which causes Traefik to accept the forbidden cross-provider reference and utilize a file-provider TCPServersTransport configuration. This mechanism can expose sensitive credentials including mTLS client certificates, SPIFFE identity information, and PROXY-protocol settings that should remain restricted to authorized namespaces.
This vulnerability aligns with CWE-284 (Improper Access Control) and represents a specific implementation of weak access control enforcement in multi-tenant environments. The issue also maps to ATT&CK technique T1078.004 (Valid Accounts: Cloud Accounts) where unauthorized access to privileged resources occurs through configuration flaws. The inconsistency in enforcement between HTTP and TCP service transport references creates an attack surface that violates the principle of least privilege fundamental to secure multi-tenant deployments.
The fix implemented in versions 3.6.23 and 3.7.7 addresses this by ensuring consistent enforcement of the crossProviderNamespaces allowlist across both HTTP and TCP serversTransport configurations. This remediation restores proper namespace isolation and prevents unauthorized cross-provider references that could lead to exposure of sensitive backend configurations. Organizations should immediately upgrade to these patched versions to eliminate the risk of privilege escalation through malformed IngressRouteTCP configurations.
This vulnerability demonstrates the critical importance of consistent security enforcement mechanisms in complex software systems where different code paths may handle similar functionality with varying levels of validation. The issue highlights how seemingly minor implementation gaps can create significant security risks in containerized and cloud-native environments where namespace isolation is fundamental to security architecture.