https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 00:11:03 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0851 certfr-2026-avi-0851 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0851 https://cve.radiocsirt.org/vuln/euvd-2026-341035 EUVD-2026-341035 https://cve.radiocsirt.org/vuln/euvd-2026-341035 https://cve.radiocsirt.org/vuln/fkie_cve-2026-65602 <p>Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references (the allowlist was only enforced for HTTP serversTransport references). A low-privileged Kubernetes user in a namespace not listed in crossProviderNamespaces can set serversTransport: foo@file on an IngressRouteTCP service, causing Traefik to accept the forbidden cross-provider reference and use a file-provider TCPServersTransport — including privileged backend mTLS client certificates, SPIFFE identity, or PROXY-protocol settings. This is fixed in 3.6.23 and 3.7.7.</p> <p>Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references (the allowlist was only enforced for HTTP serversTransport references). A low-privileged Kubernetes user in a namespace not listed in crossProviderNamespaces can set serversTransport: foo@file on an IngressRouteTCP service, causing Traefik to accept the forbidden cross-provider reference and use a file-provider TCPServersTransport — including privileged backend mTLS client certificates, SPIFFE identity, or PROXY-protocol settings. This is fixed in 3.6.23 and 3.7.7.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-65602 https://cve.radiocsirt.org/vuln/ghsa-42cj-m3vj-89wv <p><strong>Affected:</strong> Go: github.com/traefik/traefik/v3</p> <p>## Summary</p> <p>There is a medium-severity cross-provider reference vulnerability in Traefik&#39;s Kubernetes CRD provider. The `crossProviderNamespaces` allowlist is enforced for HTTP `serversTransport` references but was not enforced for `IngressRouteTCP` service `serversTransport` references. A low-privileged Kubernetes user in a namespace that is not listed in `crossProviderNamespaces` could set `serversTransport: foo@file` on an `IngressRouteTCP` service, causing Traefik to accept the forbidden cross-provider reference and use the file-provider `TCPServersTransport` — including privileged backend mTLS client certificates, SPIFFE identity, or PROXY-protocol settings. The fix applies the `crossProviderNamespaces` allowlist to TCP `serversTransport` references.</p> <p>## Patches</p> <p>- https://github.com/traefik/traefik/releases/tag/v3.6.23 - https://github.com/traefik/traefik/releases/tag/v3.7.7</p> <p>## For more information</p> <p>If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).</p> <p>&lt;details&gt; &lt;summary&gt;Original Description&lt;/summary&gt;</p> <p>## Summary</p> <p>Traefik&#39;s Kubernetes CRD provider enforces `crossProviderNamespaces` for several cross-provider references, but `IngressRouteTCP` service `serversTransport` references skip that allowlist. A low-privileged Kubernetes user in a namespace that is not listed in `crossProviderNamespaces` can still set `serversTransport: foo@file` on an `IngressRouteTCP` service. Traefik accepts the forbidde…</p> <p><strong>Affected:</strong> Go: github.com/traefik/traefik/v3</p> <p>## Summary</p> <p>There is a medium-severity cross-provider reference vulnerability in Traefik&#39;s Kubernetes CRD provider. The `crossProviderNamespaces` allowlist is enforced for HTTP `serversTransport` references but was not enforced for `IngressRouteTCP` service `serversTransport` references. A low-privileged Kubernetes user in a namespace that is not listed in `crossProviderNamespaces` could set `serversTransport: foo@file` on an `IngressRouteTCP` service, causing Traefik to accept the forbidden cross-provider reference and use the file-provider `TCPServersTransport` — including privileged backend mTLS client certificates, SPIFFE identity, or PROXY-protocol settings. The fix applies the `crossProviderNamespaces` allowlist to TCP `serversTransport` references.</p> <p>## Patches</p> <p>- https://github.com/traefik/traefik/releases/tag/v3.6.23 - https://github.com/traefik/traefik/releases/tag/v3.7.7</p> <p>## For more information</p> <p>If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).</p> <p>&lt;details&gt; &lt;summary&gt;Original Description&lt;/summary&gt;</p> <p>## Summary</p> <p>Traefik&#39;s Kubernetes CRD provider enforces `crossProviderNamespaces` for several cross-provider references, but `IngressRouteTCP` service `serversTransport` references skip that allowlist. A low-privileged Kubernetes user in a namespace that is not listed in `crossProviderNamespaces` can still set `serversTransport: foo@file` on an `IngressRouteTCP` service. Traefik accepts the forbidde…</p> https://cve.radiocsirt.org/vuln/ghsa-42cj-m3vj-89wv