CVE-2026-41174
published 2026-04-30CVE-2026-41174: Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a potential vulnerability in Traefik's…
PriorityP336medium6.4CVSS 3.1
AVNACLPRLUINSCCLILAN
EPSS
0.25%
16.6th percentile
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a potential vulnerability in Traefik's Kubernetes CRD provider cross-namespace isolation enforcement. When providers.kubernetesCRD.allowCrossNamespace=false, Traefik correctly rejects direct cross-namespace middleware references from IngressRoute objects, but fails to apply the same restriction to middleware references nested inside a Chain middleware's spec.chain.middlewares[]. An actor with permission to create or update Traefik CRDs in their own namespace can exploit this to cause Traefik to resolve and apply middleware objects from another namespace, bypassing the documented isolation boundary. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devspaces | traefik-rhel9 | — | — |
| github.com | traefik_traefik | 0 – 1.7.34 | — |
| github.com | traefik_traefik_v2 | >= 0 < 2.11.43 | 2.11.43 |
| github.com | traefik_traefik_v3 | >= 3.0.0-beta1 < 3.6.14 | 3.6.14 |
| github.com | traefik_traefik_v3 | >= 3.7.0-ea.1 < 3.7.0-rc.2 | 3.7.0-rc.2 |
| traefik | traefik | < 2.11.43 | 2.11.43 |
| traefik | traefik | — | — |
| traefik | traefik | — | — |
| traefik | traefik | >= 3.0.0 < 3.6.14 | 3.6.14 |
CVSS provenance
nvdv3.16.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
nvdv4.04.8MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Traefik up to 2.11.42/3.6.13/3.7.0-rc.1 Reverse Proxy spec.chain.middlewares middlewares[] authorization
vuldb·2026-04-30·CVSS 4.8
CVE-2026-41174 [MEDIUM] Traefik up to 2.11.42/3.6.13/3.7.0-rc.1 Reverse Proxy spec.chain.middlewares middlewares[] authorization
A vulnerability was found in Traefik up to 2.11.42/3.6.13/3.7.0-rc.1. It has been classified as problematic. This affects the function spec.chain.middlewares of the component Reverse Proxy Handler. This manipulation of the argument middlewares[] causes incorrect authorization.
The identification of this vulnerability is CVE-2026-41174. The attack can only be executed locally. There is no exploit available.
Upgrading the affected component is recommended.
GHSA
Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding
ghsa·2026-04-24
CVE-2026-41174 [MEDIUM] CWE-653 Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding
Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding
## Summary
There is a vulnerability in Traefik's Kubernetes CRD provider cross-namespace isolation enforcement.
When `providers.kubernetesCRD.allowCrossNamespace=false`, Traefik correctly rejects direct cross-namespace middleware references from `IngressRoute` objects, but fails to apply the same restriction to middleware references nested inside a `Chain` middleware's `spec.chain.middlewares[]`. An actor with permission to create or update Traefik CRDs in their own namespace can exploit this to cause Traefik to resolve and apply middleware objects from another namespace, bypassing the documented isolation boundary.
## Patches
- https://github.com/traefik/traefik/releases/tag/v2.11.43
- https://github.com/tr
Red Hat
Traefik: github.com/traefik/traefik: Traefik: Cross-namespace isolation bypass via nested middleware references
vendor_redhat·2026-04-30·CVSS 4.8
CVE-2026-41174 [MEDIUM] CWE-551 Traefik: github.com/traefik/traefik: Traefik: Cross-namespace isolation bypass via nested middleware references
Traefik: github.com/traefik/traefik: Traefik: Cross-namespace isolation bypass via nested middleware references
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a potential vulnerability in Traefik's Kubernetes CRD provider cross-namespace isolation enforcement. When providers.kubernetesCRD.allowCrossNamespace=false, Traefik correctly rejects direct cross-namespace middleware references from IngressRoute objects, but fails to apply the same restriction to middleware references nested inside a Chain middleware's spec.chain.middlewares[]. An actor with permission to create or update Traefik CRDs in their own namespace can exploit this to cause Traefik to resolve and apply middleware objects from another namespace, bypassing the
No detection rules found.
No public exploits indexed.
https://github.com/traefik/traefik/commit/df00d82fc7f12e07199551832b54de6d0e55414dhttps://github.com/traefik/traefik/releases/tag/v2.11.43https://github.com/traefik/traefik/releases/tag/v3.6.14https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2https://github.com/traefik/traefik/security/advisories/GHSA-xhjw-95fp-8vgq
2026-04-30
Published