CVE-2026-65602: 
Traefik vulnerability analysis and mitigation

CVE-2026-65602 is an incorrect authorization vulnerability in Traefik's Kubernetes CRD provider that allows a low-privileged Kubernetes user to bypass the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references. Affected versions are Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6; the vulnerability is fixed in 3.6.23 and 3.7.7. It was published on July 22, 2026, and carries a CVSS v4 base score of 5.3 (Medium) (GitHub Advisory, Github Advisory DB).

The root cause (CWE-863: Incorrect Authorization) lies in an asymmetric enforcement of the crossProviderNamespaces allowlist: the HTTP serversTransport key builder in pkg/provider/kubernetes/crd/kubernetes_http.go calls isCrossProviderNamespaceAllowed() before accepting a cross-provider reference, but the TCP equivalent in pkg/provider/kubernetes/crd/kubernetes_tcp.go (lines 321–322) returns the cross-provider name directly without that check. An attacker with low Kubernetes privileges in any namespace can create an IngressRouteTCP resource with serversTransport: foo@file; Traefik's CRD provider accepts and stores the reference, and at runtime DialerManager.Build() in pkg/tcp/dialer.go resolves the exact transport name and applies its TLS client certificates and connection settings to backend connections. A proof-of-concept (two Go test files and a YAML fixture) was included in the advisory, demonstrating both the policy bypass and the actual mTLS identity relay (GitHub Advisory).

A low-privileged Kubernetes user in a namespace that is not listed in crossProviderNamespaces can cause Traefik to use an operator-defined file-provider TCPServersTransport, including its mTLS client certificates, SPIFFE identity, or PROXY-protocol settings, when connecting to backends. This constitutes a backend identity relay: the attacker's namespace effectively impersonates a privileged transport identity that should be restricted, potentially exposing sensitive backend services to unauthorized connections and compromising the integrity and confidentiality of subsequent systems (CVSS v4 Subsequent System Confidentiality: High, Subsequent System Integrity: High) (GitHub Advisory, Github Advisory DB).

1. Identify target: Confirm the Traefik deployment is running a vulnerable version (3.6.0–3.6.22 or 3.7.0–3.7.6) with the Kubernetes CRD provider enabled and crossProviderNamespaces configured to restrict certain namespaces.
2. Obtain low-privileged access: Acquire Kubernetes credentials for any namespace not listed in crossProviderNamespaces (e.g., the default namespace).
3. Identify target transport: Determine the name of a privileged file-provider TCPServersTransport (e.g., foo@file) that carries mTLS client certificates, SPIFFE identity, or PROXY-protocol settings.
4. Create malicious IngressRouteTCP: Apply a crafted IngressRouteTCP manifest in the attacker-controlled namespace referencing the privileged transport:

apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: test.route
  namespace: default
spec:
  entryPoints:
    - foo
  routes:
    - match: HostSNI(`foo.com`)
      priority: 12
      services:
        - name: whoamitcp
          port: 8000
          tls: true
          serversTransport: foo@file

5. Bypass enforced: Traefik's CRD provider accepts the cross-provider reference without calling isCrossProviderNamespaceAllowed() on the TCP path, storing LoadBalancer.ServersTransport = "foo@file".
6. Achieve identity relay: At runtime, Traefik's DialerManager.Build() resolves foo@file and uses its TLS client certificates when connecting to the backend, effectively presenting the privileged mTLS identity to the backend service on behalf of the attacker's namespace (GitHub Advisory).

• Kubernetes API Audit Logs: Creation or modification of IngressRouteTCP resources in namespaces not listed in crossProviderNamespaces that include a serversTransport field containing a cross-provider reference (e.g., foo@file).
• Traefik Logs: Absence of error messages such as "serversTransport reference is not allowed: namespace is not in crossProviderNamespaces" for TCP routes that reference cross-provider transports — on vulnerable versions, no such error is emitted.
• Network: Unexpected mTLS connections from Traefik to backend services using client certificates associated with operator-defined file-provider transports, originating from routes in unauthorized namespaces.
• Configuration Artifacts: IngressRouteTCP manifests in non-privileged namespaces containing serversTransport: <name>@file or serversTransport: <name>@<external-provider> fields (GitHub Advisory).

Upgrade Traefik to version 3.6.23 (if using the 3.6.x branch) or 3.7.7 (if using the 3.7.x branch), which apply the crossProviderNamespaces allowlist check to TCP serversTransport references, mirroring the existing enforcement on the HTTP path. No configuration-based workaround is documented; the only reliable remediation is upgrading to a patched release. As an interim measure, operators can audit all IngressRouteTCP resources across namespaces for cross-provider serversTransport references and remove unauthorized ones (GitHub Advisory, Github Advisory DB).

The advisory was published by Traefik maintainer rtribotte on July 9, 2026, and credited researchers CuB3y0nd and james-yusuke for the report. VulnCheck independently catalogued the vulnerability (EUVD-2026-47646). No significant broader media coverage or notable community commentary beyond the official advisory has been identified at this time (GitHub Advisory).