Executive brief
Traefik, a popular cloud-native application proxy, contains a security flaw in how it handles network traffic rules in Kubernetes environments. A user with limited permissions could bypass security restrictions to use sensitive credentials, such as digital certificates, that they should not have access to. This could allow an unauthorized user to impersonate a trusted service when connecting to internal databases or backend systems, potentially leading to unauthorized data access.
Technical details
A cross-provider reference vulnerability exists in Traefik's Kubernetes CRD provider. While the 'crossProviderNamespaces' allowlist is correctly enforced for HTTP 'serversTransport' references, it is bypassed for 'IngressRouteTCP' service 'serversTransport' references. A low-privileged Kubernetes user in a non-allowlisted namespace can reference a 'TCPServersTransport' from another provider (e.g., the file provider). This allows the attacker to utilize privileged backend mTLS client certificates, SPIFFE identities, or PROXY-protocol settings defined by an operator. The root cause is a missing authorization check in the TCP key builder logic within 'pkg/provider/kubernetes/crd/kubernetes_tcp.go'. Patches are available in versions 3.6.23 and 3.7.7.
Affected products
- Traefik Labs traefik/traefik/v3 >= 3.6.0, <= 3.6.22, >= 3.7.0, <= 3.7.6
Timeline
- 2026-07-09: advisory: Initial GitHub Advisory published
- 2026-08-05: patched: Fixes released in versions 3.6.23 and 3.7.7