Cross-Namespace Isolation Issue in Traefik HTTP Reverse Proxy and Load Balancer

CVE-2026-41174

What is CVE-2026-41174?

A cross-namespace isolation vulnerability exists in the Traefik HTTP reverse proxy prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2. This issue arises when the Kubernetes CRD provider allows cross-namespace middleware references to be resolved without proper restrictions. Despite correct rejection of direct cross-namespace references in IngressRoute objects when 'providers.kubernetesCRD.allowCrossNamespace' is false, the same security measure does not apply to middleware references nested within Chain middleware's configuration. This flaw enables malicious actors with permissions to create or update CRDs in their own namespace to exploit the isolation boundary by referencing middleware from another namespace. Traefik has released patches to address this vulnerability in the specified versions.

References