CVE-2026-41174: Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding
Vulnerability summary
CVE-2026-41174 is a medium (CVSS 6.4) vulnerability in traefik. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 16.9% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 4.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 30-04-2026PublishedVulnerability first disclosed.
- 04-05-2026Last modifiedVulnerability information updated.
Description
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a potential vulnerability in Traefik's Kubernetes CRD provider cross-namespace isolation enforcement. When providers.kubernetesCRD.allowCrossNamespace=false, Traefik correctly rejects direct cross-namespace middleware references from IngressRoute objects, but fails to apply the same restriction to middleware references nested inside a Chain middleware's spec.chain.middlewares[]. An actor with permission to create or update Traefik CRDs in their own namespace can exploit this to cause Traefik to resolve and apply middleware objects from another namespace, bypassing the documented isolation boundary. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.
CVSS metrics
6 scores · 4 sources · 2 versions- OSV · GoEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- OSV · ChainguardEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- NVDNIST4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · GoEcosystem advisory · calculated6.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.25%
Chance of exploitation in the next 30 days
Percentile
17%
Versus all other CVEs
30-day change
Decrease -0.02 pp
From 0.27% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundTraefik
Maturity: poc
Weaknesses
CWE · root cause- CWE-653Improper Isolation or CompartmentalizationThe product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.
- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard2 products
- traefik-3.5All versions (No fix recorded)
- traefik-fips-3.5All versions (No fix recorded)
Github.com/traefik/traefik2 products
- v2< 2.11.43
- v3≥ 3.0.0-beta1, < 3.6.14 | ≥ 3.7.0-ea.1, < 3.7.0-rc.2
Github.com/traefik1 product
- traefik≤ 1.7.34 | All versions (No fix recorded)
Traefik1 product
- traefik≥ 3.7.0-ea.1, < 3.7.0-rc.2 | < 2.11.43 | ≥ 3.0.0, < 3.6.14 | 3.7.0:ea1 | 3.7.0:ea2 | 3.7.0:ea3 | 3.7.0:rc1
4 vendors · 6 products
References
8 links- github.com/traefik/traefik/security/advisories/GHSA-xhjw-95fp-8vgqX Refsource CONFIRMWEBAdvisoryExploitPatchVendor Advisory
- github.com/traefik/traefik/commit/df00d82fc7f12e07199551832b54de6d0e55414dX Refsource MISCWEBFIXPatch
- github.com/traefik/traefikPACKAGE