CVE-2026-71325 in Traefik
Summary
by MITRE • 08/07/2026
Traefik is an open-source edge router that makes publishing services a fun and easy experience. Prior to 2.11.54, 3.6.25, and 3.7.10, cross-namespace @kubernetescrd references are not rejected for TraefikService backend references resolved by the service resolver. A tenant confined by RBAC to a single namespace can therefore bind its own router to a TraefikService owned by another namespace and expose or reroute that namespace's backend, defeating the namespace isolation allowCrossNamespace=false is meant to enforce. This issue is fixed in version 2.11.54, 3.6.25, 3.7.10.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/07/2026
This vulnerability represents a critical authorization bypass in Traefik's Kubernetes integration that undermines fundamental namespace isolation principles. The flaw exists in the service resolver component where Traefik fails to properly validate cross-namespace references when processing TraefikService backend configurations. Specifically, when a tenant operates within a restricted namespace through RBAC controls, they can still exploit this vulnerability to reference TraefikService objects located in different namespaces, effectively circumventing the intended allowCrossNamespace=false configuration that should enforce strict namespace boundaries.
The technical implementation of this vulnerability stems from insufficient validation logic within Traefik's Kubernetes controller. When processing router configurations that reference TraefikService resources through @kubernetescrd references, the system does not perform proper namespace ownership checks before resolving backend references. This allows a malicious actor with access to a single namespace to create router rules that point to services in other namespaces, enabling them to expose or redirect traffic to resources they should not have access to.
The operational impact of this vulnerability is severe as it completely defeats the purpose of namespace-based security controls that are fundamental to Kubernetes architecture. Attackers can leverage this weakness to perform lateral movement across namespace boundaries, potentially accessing sensitive data, services, or backend systems belonging to other tenants in multi-tenant environments. This vulnerability particularly affects shared hosting environments where multiple teams or organizations rely on namespace isolation for security separation.
This vulnerability maps directly to CWE-284 (Improper Access Control) and aligns with ATT&CK technique T1566 (Phishing) through the potential for attackers to use this access bypass to expand their attack surface. The fix implemented in versions 2.11.54, 3.6.25, and 3.7.10 addresses the core validation issue by implementing proper namespace checking mechanisms that ensure TraefikService references are only resolved when they originate from the same namespace as the referencing router, or when explicit cross-namespace permissions are granted through proper RBAC configuration.
Organizations should immediately upgrade to the patched versions and review their existing Traefik configurations to ensure no unauthorized cross-namespace references have been established. Additionally, security teams should implement monitoring for unusual routing patterns that might indicate exploitation attempts, particularly around namespace boundary crossings in Traefik logs and audit trails. The vulnerability demonstrates the critical importance of proper access control validation in distributed systems where multiple tenants share infrastructure resources while maintaining isolation boundaries.