https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T05:42:57.147014+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-11279 bdu:2026-11279 2026-10-06T05:42:57.149764+00:00 bdu:2026-11279 https://cve.radiocsirt.org/vuln/euvd-2026-349368 EUVD-2026-349368 2026-10-06T05:42:57.149801+00:00 EUVD-2026-349368 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71325 fkie_cve-2026-71325 2026-10-06T05:42:57.149815+00:00

Traefik is an open-source edge router that makes publishing services a fun and easy experience. Prior to 2.11.54, 3.6.25, and 3.7.10, cross-namespace @kubernetescrd references are not rejected for TraefikService backend references resolved by the service resolver. A tenant confined by RBAC to a single namespace can therefore bind its own router to a TraefikService owned by another namespace and expose or reroute that namespace's backend, defeating the namespace isolation allowCrossNamespace=false is meant to enforce. This issue is fixed in version 2.11.54, 3.6.25, 3.7.10.

 https://cve.radiocsirt.org/vuln/ghsa-62fc-8686-hfmq GHSA-62fc-8686-hfmq β€” Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef 2026-10-06T05:42:57.149848+00:00

Affected: Go: github.com/traefik/traefik/v2, Go: github.com/traefik/traefik/v3, Go: github.com/traefik/traefik

## Summary

There is a medium severity vulnerability in Traefik's Kubernetes CRD provider. When `providers.kubernetesCRD.allowCrossNamespace` is disabled β€” the default β€” cross-namespace `@kubernetescrd` references are rejected for middlewares, TLS options and HTTP/TCP ServersTransports, but the same restriction was not applied to `TraefikService` backend references resolved by the service resolver. A tenant confined by RBAC to a single namespace can therefore bind its own router to a `TraefikService` owned by another namespace and expose or reroute that namespace's backend, defeating the namespace isolation `allowCrossNamespace=false` is meant to enforce. Traefik v2 releases and the unmaintained v3 minor lines below v3.6 are affected and will not receive a patch on their own line; the remedy for those users is upgrading to a maintained, patched release.

## Patches

- https://github.com/traefik/traefik/releases/tag/v2.11.54 - https://github.com/traefik/traefik/releases/tag/v3.6.25 - https://github.com/traefik/traefik/releases/tag/v3.7.10

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

<details> <summary>Original Description</summary>

### Summary When `providers.kubernetesCRD.allowCrossNamespace=false` (the default), Traefik correctly rejects cross-namespace `@kubernetescrd` references for middlewares, TLS options, and HTTP/TCP `ServersTransport`, but it does not apply th…