CVE-2026-65602

Name of the Vulnerable Software and Affected Versions Traefik versions 3.6.0 through 3.6.22 Traefik versions 3.7.0 through 3.7.6

Description Traefik fails to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references, as the allowlist was only applied to HTTP references. A low-privileged Kubernetes user in a namespace not included in the crossProviderNamespaces list can configure serversTransport: foo@file on an IngRouteTCP service. This allows Traefik to accept a forbidden cross-provider reference and utilize a file-provider TCPServersTransport, potentially granting access to privileged backend mTLS client certificates, SPIFFE identity, or PROXY-protocol settings.

Recommendations Update Traefik versions 3.6.0 through 3.6.22 to version 3.6.23. Update Traefik versions 3.7.0 through 3.7.6 to version 3.7.7.