High severity · published Jul 22, 2026
CVE-2026-65602
Traefik before 3.6.23 IngressRouteTCP ServersTransport Namespace Bypass
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references (the allowlist was only enforced for HTTP serversTransport references). A low-privileged Kubernetes user in a namespace not listed in crossProviderNamespaces can set serversTransport: foo@file on an IngressRouteTCP service, causing Traefik to accept the forbidden cross-provider reference and use a file-provider TCPServersTransport — including privileged backend mTLS client certificates, SPIFFE identity, or PROXY-protocol settings. This is fixed in 3.6.23 and 3.7.7.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TR
traefik · traefik
3.6.0 before 3.6.23; 3.7.0 before 3.7.7 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-65602
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-65602
vendor-advisory
https://github.com/traefik/traefik/security/advisories/GHSA-42cj-m3vj-89wv
patch
https://github.com/traefik/traefik/commit/26c96a3935cafb473f4a5bae1886560d9aa4e4f0
third-party-advisory
https://www.vulncheck.com/advisories/traefik-before-ingressroutetcp-serverstransport-namespace-bypass
More from traefik
10.0
CVE-2026-54763
Traefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
10.0
CVE-2026-53622
Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts
10.0
CVE-2026-48491
Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass
10.0
CVE-2026-48020
Traefik StripPrefix Route-Level Auth Bypass via Path Normalization
10.0
CVE-2026-39858
Traefik: Forwarded alias spoofing top pre-auth decision bypass