CVE-2026-71325

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 2.11.54 Traefik versions prior to 3.6.25 Traefik versions prior to 3.7.10

Description An issue exists in the Kubernetes CRD provider where cross-namespace @kubernetescrd references are not properly rejected for TraefikService backend references resolved by the service resolver. This occurs even when the providers.kubernetesCRD.allowCrossNamespace setting is disabled (which is the default).

In a multi-tenant environment, a user restricted by RBAC to a single namespace can bind their own router to a TraefikService owned by another namespace by referencing it as <victim-namespace>-<name>@kubernetescrd. This allows the user to expose or reroute traffic to a backend in a different namespace, bypassing the intended namespace isolation. The root cause is that the nameAndService() function fails to apply the same namespace validation checks used by other resolvers for middlewares and TLS options.

Recommendations Update to version 2.11.54. Update to version 3.6.25. Update to version 3.7.10.