Cross-Namespace Access Issue in Traefik Open-Source Edge Router
CVE-2026-71325
4.8MEDIUM
What is CVE-2026-71325?
Traefik, an open-source edge router, has a vulnerability whereby cross-namespace references are not properly restricted for TraefikService backend references. This flaw permits a tenant restricted by RBAC to a single namespace to bind their router to a TraefikService belonging to a different namespace, effectively breaching the intended namespace isolation. This vulnerability has been addressed in Traefik versions 2.11.54, 3.6.25, and 3.7.10, enhancing security and enforcing the namespace isolation policy.
Affected Version(s)
traefik < 2.11.54 < 2.11.54
traefik >= 3.0.0, < 3.6.25 < 3.0.0, 3.6.25
traefik >= 3.7.0, < 3.7.10 < 3.7.0, 3.7.10