CVE-2026-41174 Details
Description
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a potential vulnerability in Traefik's Kubernetes CRD provider cross-namespace isolation enforcement. When providers.kubernetesCRD.allowCrossNamespace=false, Traefik correctly rejects direct cross-namespace middleware references from IngressRoute objects, but fails to apply the same restriction to middleware references nested inside a Chain middleware's spec.chain.middlewares[]. An actor with permission to create or update Traefik CRDs in their own namespace can exploit this to cause Traefik to resolve and apply middleware objects from another namespace, bypassing the documented isolation boundary. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.
A vulnerability exists in Traefik's Kubernetes Custom Resource Definition (CRD) provider regarding cross-namespace isolation. When the 'allowCrossNamespace' option is set to false, Traefik properly rejects direct cross-namespace middleware references in IngressRoute objects. However, it does not enforce the same restriction for middleware references within a Chain middleware's 'spec.chain.middlewares[]' array. This flaw allows users with permission to create or update Traefik CRDs in their own namespace to reference and apply middleware from other namespaces, circumventing the intended isolation. This issue affects Traefik versions through 2.11.42, 3.6.13, and 3.7.0-rc.1.
Users can upgrade to Traefik versions 2.11.43, 3.6.14, or 3.7.0-rc.2, all of which include the necessary patch to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/traefik/traefik/commit/df00d82fc7f12e07199551832b54de6d0e55414d | [email protected] | Patch |
| https://github.com/traefik/traefik/releases/tag/v2.11.43 | [email protected] | ProductRelease Notes |
| https://github.com/traefik/traefik/releases/tag/v3.6.14 | [email protected] | ProductRelease Notes |
| https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2 | [email protected] | ProductRelease Notes |
| https://github.com/traefik/traefik/security/advisories/GHSA-xhjw-95fp-8vgq | [email protected] | ExploitPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-653 | Improper Isolation or Compartmentalization | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| traefik traefik | < 2.11.43 >= 3.0.0, < 3.6.14 3.7.0 ea1 3.7.0 ea2 3.7.0 ea3 3.7.0 rc1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 1, 2026 | Initial Analysis | [email protected] |
| Apr 30, 2026 | New CVE Received | [email protected] |