CVE-2026-41174: Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding

What it is stated by the CNA

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a potential vulnerability in Traefik's Kubernetes CRD provider cross-namespace isolation enforcement. When providers.kubernetesCRD.allowCrossNamespace=false, Traefik correctly rejects direct cross-namespace middleware references from IngressRoute objects, but fails to apply the same restriction to middleware references nested inside a Chain middleware's spec.chain.middlewares[]. An actor with permission to create or update Traefik CRDs in their own namespace can exploit this to cause Traefik to resolve and apply middleware objects from another namespace, bypassing the documented isolation boundary. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.

weakness

CWE-863: Incorrect Authorization; CWE-653: Improper Isolation or Compartmentalization

affected

traefik

published ranges

traefik < 2.11.43; traefik >= 3.0.0 < 3.6.14; traefik 3.7.0-ea1; traefik 3.7.0-ea2; and 2 more on the CVE page

first unaffected version, by branch

traefik 2.11.43; traefik 3.6.14

fixed by package (from OSV advisories)

github.com/traefik/traefik/v2 (Go): 2.11.43 GHSA-xhjw-95fp-8vgq GO-2026-5760github.com/traefik/traefik/v3 (Go): 3.6.14; 3.7.0-rc.2 GHSA-xhjw-95fp-8vgq GO-2026-5760

later fixes (from OSV advisories)

github.com/traefik/traefik/v2 2.11.43 is inside a range CVE-2026-41181 (GHSA-p6hg-qh38-555r) lists as affected. That advisory is fixed in 2.11.44.github.com/traefik/traefik/v2 2.11.43 is inside a range CVE-2026-44774 (GHSA-96qj-4jj5-wcjc) lists as affected. That advisory is fixed in 2.11.46.github.com/traefik/traefik/v2 2.11.43 is inside a range CVE-2026-48020 (GHSA-xf64-8mw2-4gr2) lists as affected. That advisory is fixed in 2.11.48.github.com/traefik/traefik/v2 2.11.43 is inside a range CVE-2026-48491 (GHSA-5r4w-85f3-pw66) lists as affected. That advisory is fixed in 2.11.48.github.com/traefik/traefik/v2 2.11.43 is inside a range CVE-2026-53622 (GHSA-9cr8-q42q-g8m7) lists as affected. That advisory is fixed in 2.11.51.github.com/traefik/traefik/v2 2.11.43 is inside a range CVE-2026-54763 (GHSA-x677-9fxg-v5c5) lists as affected. That advisory is fixed in 2.11.51.

severity

4.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

assigned by

GitHub_M

published

2026-04-30

check us github.com github.com github.com github.com

Exploit code held, dated

exploit code

None held in the PoC-in-GitHub feed. A public repository changes this brief.

What moved held, dated

6 observations held. A step marked with a scoring model moved because the measurement was replaced, not because the vulnerability changed.

Outside the record researched, cited

This section reads the record's references and adds cited findings from outside it. It needs an account. Everything above is held facts and is complete without it.

Sign in to add the researched section

How to check this

Every value above is held with two dates: when it was true upstream (as_of) and when we recorded it (tx_from). Re-derive the exploit probability as it stood on any date:

SELECT value, source, source_version, as_of, tx_from
FROM volatile_valid_as_of('CVE-2026-41174', '2026-11-01T23:59:59.999999Z', now());