CVE-2026-65602
Received Received - Intake

Traefik TCP IngressRoute Cross-Provider Bypass

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: VulnCheck

Description
Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references (the allowlist was only enforced for HTTP serversTransport references). A low-privileged Kubernetes user in a namespace not listed in crossProviderNamespaces can set serversTransport: foo@file on an IngressRouteTCP service, causing Traefik to accept the forbidden cross-provider reference and use a file-provider TCPServersTransport — including privileged backend mTLS client certificates, SPIFFE identity, or PROXY-protocol settings. This is fixed in 3.6.23 and 3.7.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-65602
EUVD
EUVD-2026-47646

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
traefik traefik From 3.6.0 (inc) to 3.6.22 (inc)
traefik traefik From 3.7.0 (inc) to 3.7.6 (inc)
traefik traefik 3.6.23
traefik traefik 3.7.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-65602 is a vulnerability in Traefik versions 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6. It allows a low-privileged Kubernetes user in a non-allowed namespace to bypass namespace restrictions by setting a serversTransport reference to a file-provider TCPServersTransport in an IngressRouteTCP service. This bypasses the crossProviderNamespaces allowlist, which was only enforced for HTTP references.

Detection Guidance

Check Traefik version with: kubectl get pods -n <traefik-namespace> -l app=traefik -o jsonpath='{.items[0].spec.containers[0].image}'. Versions 3.6.0-3.6.22 and 3.7.0-3.7.6 are vulnerable. Inspect IngressRouteTCP resources for serversTransport: foo@file references in non-allowed namespaces.

Impact Analysis

An attacker could exploit this to access privileged backend configurations such as mTLS client certificates, SPIFFE identity, or PROXY-protocol settings. This could lead to unauthorized access to sensitive data or systems, depending on the backend configurations exposed.

Mitigation Strategies

Upgrade Traefik to versions 3.6.23 or 3.7.7 or later immediately. Review and restrict crossProviderNamespaces allowlist in Traefik configuration. Audit all IngressRouteTCP resources for unauthorized serversTransport references.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65602. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart