Is CVE-2026-65602 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65602 being exploited in the wild.

How severe is CVE-2026-65602?

Medium severity, with a CVSS score of 4, published 22 July 2026.

Which products and versions are affected?

github.com/traefik/traefik (Go) SEMVER:introduced=0; github.com/traefik/traefik/v2 (Go) SEMVER:introduced=0; github.com/traefik/traefik/v3 (Go) SEMVER:introduced=3.6.0,fixed=3.6.23, SEMVER:introduced=3.6.0,fixed=3.6.23,introduced=3.7.0,fixed=3.7.7.

Is there a fix for CVE-2026-65602?

Yes. github.com/traefik/traefik/v3 (Go): upgrade to 3.6.23, 3.7.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65602 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-65602?

Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65602: Traefik authorization bypass in IngressRouteTCP cross-provider references

CVE-2026-65602 · Severity: medium · CVSS 4 · Published 2026-07-22

Traefik, a popular cloud-native application proxy, contains a security flaw in how it handles network traffic rules in Kubernetes environments. A user with limited permissions could bypass security restrictions to use sensitive credentials, such as digital certificates, that they should not have access to. This could allow an unauthorized user to impersonate a trusted service when connecting to internal databases or backend systems, potentially leading to unauthorized data access.

Technologies: github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go), Traefik Labs Traefik Proxy. Vendors: Go, Traefik Labs.

Quick answers

Is CVE-2026-65602 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65602 being exploited in the wild.
How severe is CVE-2026-65602?: Medium severity, with a CVSS score of 4, published 22 July 2026.
Which products and versions are affected?: github.com/traefik/traefik (Go) SEMVER:introduced=0; github.com/traefik/traefik/v2 (Go) SEMVER:introduced=0; github.com/traefik/traefik/v3 (Go) SEMVER:introduced=3.6.0,fixed=3.6.23, SEMVER:introduced=3.6.0,fixed=3.6.23,introduced=3.7.0,fixed=3.7.7.
Is there a fix for CVE-2026-65602?: Yes. github.com/traefik/traefik/v3 (Go): upgrade to 3.6.23, 3.7.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65602 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-65602?: Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/traefik/traefik/v3 (Go): upgrade to 3.6.23, 3.7.7 or later
```
go get github.com/traefik/traefik/v3@v3.7.7
```

Technical details

A cross-provider reference vulnerability exists in Traefik's Kubernetes CRD provider. While the 'crossProviderNamespaces' allowlist is correctly enforced for HTTP 'serversTransport' references, it is bypassed for 'IngressRouteTCP' service 'serversTransport' references. A low-privileged Kubernetes user in a non-allowlisted namespace can reference a 'TCPServersTransport' from another provider (e.g., the file provider). This allows the attacker to utilize privileged backend mTLS client certificates, SPIFFE identities, or PROXY-protocol settings defined by an operator. The root cause is a missing authorization check in the TCP key builder logic within 'pkg/provider/kubernetes/crd/kubernetes_tcp.go'. Patches are available in versions 3.6.23 and 3.7.7.

Affected products

Traefik Labs traefik/traefik/v3 >= 3.6.0, <= 3.6.22, >= 3.7.0, <= 3.7.6

Identifiers

CVE-2026-65602
GHSA-42cj-m3vj-89wv
GO-2026-6192

Timeline

2026-07-09: advisory: Initial GitHub Advisory published
2026-08-05: patched: Fixes released in versions 3.6.23 and 3.7.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.