CVE-2026-65602: Traefik before 3.6.23 IngressRouteTCP ServersTransport Namespace Bypass
Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references (the allowlist was only enforced for HTTP serversTransport references). A low-privileged Kubernetes user in a namespace not listed in crossProviderNamespaces can set serversTransport: foo@file on an IngressRouteTCP service, causing Traefik to accept the forbidden cross-provider reference and use a file-provider TCPServersTransport — including privileged backend mTLS client certificates, SPIFFE identity, or PROXY-protocol settings. This is fixed in 3.6.23 and 3.7.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.6.23 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.7.7
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65602?
The severity of CVE-2026-65602 is rated as medium with a CVSS score of 5.3.
How do I fix CVE-2026-65602?
To fix CVE-2026-65602, upgrade Traefik to version 3.6.23 or later.
What is the impact of CVE-2026-65602?
CVE-2026-65602 allows low-privileged Kubernetes users to bypass namespace restrictions for IngressRouteTCP servers.
Which versions of Traefik are affected by CVE-2026-65602?
Traefik versions 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 are affected by CVE-2026-65602.
What components are involved in CVE-2026-65602?
CVE-2026-65602 involves the Traefik IngressRouteTCP serversTransport and its namespace verification process.