Most recent entries from all

bdu:2026-06477

2026-10-03T13:11:32.845727+00:00

bdu:2026-06477

certfr-2026-avi-0490 — De multiples vulnérabilités ont été découvertes dans Traefik. Elles permettent à un attaquant de provoquer une atteinte…

2026-10-03T13:11:32.845774+00:00

certfr-2026-avi-0490

Withdrawn: CLEANSTART-2026-QI45196 — Security fixes in forecastle 1.0.159-r1

2026-10-03T13:11:32.845794+00:00

Withdrawn by the publisher.

Affected: CleanStart: forecastle

Package forecastle version 1.0.159-r1 fixes 43 vulnerabilities: CVE-2026-40611, CVE-2026-34986, CVE-2026-48020, CVE-2026-26999, CVE-2026-29054...

EUVD-2026-308343

2026-10-03T13:11:32.845826+00:00

EUVD-2026-308343

fkie_cve-2026-41174

2026-10-03T13:11:32.845839+00:00

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a potential vulnerability in Traefik's Kubernetes CRD provider cross-namespace isolation enforcement. When providers.kubernetesCRD.allowCrossNamespace=false, Traefik correctly rejects direct cross-namespace middleware references from IngressRoute objects, but fails to apply the same restriction to middleware references nested inside a Chain middleware's spec.chain.middlewares[]. An actor with permission to create or update Traefik CRDs in their own namespace can exploit this to cause Traefik to resolve and apply middleware objects from another namespace, bypassing the documented isolation boundary. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.

GHSA-xhjw-95fp-8vgq — Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding

2026-10-03T13:11:32.845867+00:00

Affected: Go: github.com/traefik/traefik/v3, Go: github.com/traefik/traefik/v2, Go: github.com/traefik/traefik

## Summary

There is a vulnerability in Traefik's Kubernetes CRD provider cross-namespace isolation enforcement.

When `providers.kubernetesCRD.allowCrossNamespace=false`, Traefik correctly rejects direct cross-namespace middleware references from `IngressRoute` objects, but fails to apply the same restriction to middleware references nested inside a `Chain` middleware's `spec.chain.middlewares[]`. An actor with permission to create or update Traefik CRDs in their own namespace can exploit this to cause Traefik to resolve and apply middleware objects from another namespace, bypassing the documented isolation boundary.

## Patches

- https://github.com/traefik/traefik/releases/tag/v2.11.43 - https://github.com/traefik/traefik/releases/tag/v3.6.14 - https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2

## For more information

If there are any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

Original Description

### Summary When `providers.kubernetesCRD.allowCrossNamespace=false`, Traefik still allows a namespace-local `Middleware` of type `Chain` to reference middleware objects from another namespace via `spec.chain.middlewares[].namespace`.

This bypasses the documented cross-namespace restriction and allows an actor with permission to create or update Traefik CRDs in namespace A to bind middleware defined in namespace B to routes in namespace A.

### Details Traefik documents…

openSUSE-SU-2026:10697-1 — traefik-3.6.15-1.1 on GA media

2026-10-03T13:11:32.845933+00:00

traefik-3.6.15-1.1 on GA media