Database/Container, Kubernetes & orchestration

Traefik: cross-namespace TraefikService references are not rejected, defeating allowCrossNamespace=false isolation

CVSS 4.8CVE-2026-71325Container, Kubernetes & orchestrationcurated

Impact

The service resolver does not reject cross-namespace @kubernetescrd references for TraefikService backends, so a tenant confined by RBAC to one namespace can point its own router at a TraefikService owned by another namespace. That exposes or reroutes the other tenant's backend through an ingress the victim does not control, which is exactly what allowCrossNamespace=false is configured to prevent. On a multi-tenant GPU cloud that uses namespace-per-tenant with a shared Traefik ingress, this is a tenant-to-tenant boundary failure: traffic meant for one customer's inference endpoint can be reached or redirected by another.

Who can reach it

Any tenant with RBAC to create IngressRoute and TraefikService resources in their own namespace on a cluster running a shared Traefik ingress controller. Authenticated to the Kubernetes API; no node or control-plane access needed.

What to do

Upgrade Traefik to 2.11.54, 3.6.25 or 3.7.10 depending on branch. This is a rolling restart of the ingress controller deployment - no node drain - but plan for connection resets on long-lived streams during the rollout. Until patched, audit TraefikService references in tenant namespaces for cross-namespace targets, since allowCrossNamespace=false does not block them on affected versions.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-71325 https://github.com/traefik/traefik/security/advisories/GHSA-62fc-8686-hfmq https://github.com/traefik/traefik/commit/65ebf4b47fbdc33e3856803a5844a404e094d52d https://github.com/traefik/traefik/releases/tag/v3.7.10

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.