CVE-2026-71325
Description
Traefik is an open-source edge router that makes publishing services a fun and easy experience. Prior to 2.11.54, 3.6.25, and 3.7.10, cross-namespace @kubernetescrd references are not rejected for TraefikService backend references resolved by the service resolver. A tenant confined by RBAC to a single namespace can therefore bind its own router to a TraefikService owned by another namespace and expose or reroute that namespace's backend, defeating the namespace isolation allowCrossNamespace=false is meant to enforce. This issue is fixed in version 2.11.54, 3.6.25, 3.7.10.
How to fix
- traefik traefik2.11.54, 3.6.25 or later
- github.com/traefik/traefik/v22.11.54 or later
- github.com/traefik/traefik/v33.6.25, 3.7.10 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| traefik traefik | v < 2.11.54, 3.0.0 ≤ v < 3.6.25, 3.7.0 ≤ v ≤ 3.7.10 | 2.11.54, 3.6.25 |
| github.com/traefik/traefik/v2Go | v < 2.11.54 | 2.11.54 |
| github.com/traefik/traefik/v3Go | 3.0.0 ≤ v < 3.6.25, 3.7.0 ≤ v < 3.7.10 | 3.6.25, 3.7.10 |
| github.com/traefik/traefikGo | v ≤ 1.7.34, No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.