Executive brief
Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding in github.com/traefik/traefik
Affected products
- Go github.com/traefik/traefik/v3
- Go github.com/traefik/traefik/v2
- Go github.com/traefik/traefik
Junglewise Threat Intelligence
CVE-2026-41174: GO-2026-5760 - Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding in github.com/traefik/traefik
CVE-2026-41174 · Severity: low · CVSS 3.1 · Published 2026-06-25
Technologies: github.com/traefik/traefik/v3 (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik (Go). Vendors: Go.
Related threats
- Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPo
- Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form he
- Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request targ
- Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Co
- Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does