CVE-2026-65602: Traefik Privilege Escalation Vulnerability

CVE-2026-65602 Overview

CVE-2026-65602 affects Traefik versions 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6. The vulnerability stems from missing enforcement of the crossProviderNamespaces allowlist on IngressRouteTCP service serversTransport references. The allowlist was only applied to HTTP serversTransport references, leaving the TCP path exposed. A low-privileged Kubernetes user in a namespace outside the allowlist can set serversTransport: foo@file on an IngressRouteTCP service. Traefik then accepts the forbidden cross-provider reference and applies a file-provider TCPServersTransport, including privileged backend mTLS client certificates, SPIFFE identity, and PROXY-protocol settings. Traefik Labs fixed the issue in 3.6.23 and 3.7.7.

Critical Impact
A tenant without cross-provider privileges can attach file-provider TCP transport configuration to its own route, gaining access to privileged mTLS client certificates and SPIFFE identities intended for other workloads.

Affected Products

Traefik 3.6.0 through 3.6.22
Traefik 3.7.0 through 3.7.6
Kubernetes deployments using the IngressRouteTCP custom resource with a file-provider TCPServersTransport

Discovery Timeline

2026-07-22 - CVE-2026-65602 published to the National Vulnerability Database
2026-07-22 - Last updated in the NVD database

Technical Details for CVE-2026-65602

Vulnerability Analysis

Traefik supports multiple configuration providers, including the Kubernetes CRD provider and the static file provider. The crossProviderNamespaces setting restricts which Kubernetes namespaces may reference objects defined by another provider using the name@provider syntax. This control existed for HTTP serversTransport references but was not applied to IngressRouteTCP service serversTransport references. The gap maps to [CWE-863: Incorrect Authorization]. Any Kubernetes user with permission to create or edit IngressRouteTCP resources in a non-allowlisted namespace can reference a file-provider TCPServersTransport such as foo@file and have Traefik honor it at connection time.

Root Cause

The authorization check that validates cross-provider references was implemented only on the HTTP path of the routing configuration builder. The TCP path built the TCPServersTransport reference from user-supplied CRD input without consulting crossProviderNamespaces. As a result, the file-provider transport - which typically holds cluster-wide mTLS material and SPIFFE identity - could be attached to a tenant-controlled route.

Attack Vector

Exploitation requires network reachability to the Kubernetes API and low-privileged rights to create or modify IngressRouteTCP objects in a namespace not listed in crossProviderNamespaces. The attacker sets the service serversTransport value to a file-provider transport name such as foo@file. Traefik reconciles the resource, binds the privileged file-provider TCPServersTransport to the tenant route, and uses its client certificate, SPIFFE identity, and PROXY-protocol settings when connecting to backends the attacker selects.

No verified proof-of-concept exploit code is published. The upstream fix ships in the release chain reflected in the patch metadata below.

text

 OutputType = "file"
 FileName = "traefik_changelog.md"
 
-# example new bugfix v3.7.4
+# example new bugfix v3.7.5
 CurrentRef = "v3.7"
-PreviousRef = "v3.7.3"
+PreviousRef = "v3.7.4"
 BaseBranch = "v3.7"
-FutureCurrentRefName = "v3.7.4"
+FutureCurrentRefName = "v3.7.5"
 
 ThresholdPreviousRef = 10000
 ThresholdCurrentRef = 10000

Source: Traefik GitHub commit 26c96a3

Detection Methods for CVE-2026-65602

Indicators of Compromise

IngressRouteTCP resources whose spec.routes[].services[].serversTransport value contains the @file suffix or any provider suffix other than @kubernetescrd.
New or modified IngressRouteTCP objects in namespaces not enumerated in the Traefik static configuration providers.kubernetesCRD.allowCrossNamespace or crossProviderNamespaces allowlist.
Outbound TCP connections from Traefik pods presenting mTLS client certificates or SPIFFE identities not associated with the requesting tenant.

Detection Strategies

Audit all IngressRouteTCP custom resources cluster-wide and flag any serversTransport reference that contains the @ separator.
Compare the namespace of each flagged IngressRouteTCP against the crossProviderNamespaces allowlist configured on the Traefik controller.
Correlate Kubernetes API audit logs for create and update verbs on ingressroutetcps.traefik.io with the Traefik version running in the cluster.

Monitoring Recommendations

Enable Kubernetes API audit logging at RequestResponse level for the traefik.io API group and forward events to a central analytics platform.
Alert on any change to Traefik static configuration files that add or modify entries under tcpServersTransports.
Track the running Traefik image tag through admission controls and alert when versions 3.6.0-3.6.22 or 3.7.0-3.7.6 are deployed.

How to Mitigate CVE-2026-65602

Immediate Actions Required

Upgrade Traefik to 3.6.23 or 3.7.7, which enforce crossProviderNamespaces on IngressRouteTCPserversTransport references.
Enumerate every IngressRouteTCP resource and remove serversTransport values that use a non-kubernetescrd provider suffix unless the namespace is explicitly trusted.
Restrict Kubernetes RBAC so that only trusted service accounts can create or modify ingressroutetcps.traefik.io objects.
Rotate any backend mTLS client certificates or SPIFFE credentials referenced by file-provider TCPServersTransport entries if tenant abuse is suspected.

Patch Information

The fix is delivered in Traefik 3.6.23 and 3.7.7. Refer to GitHub Security Advisory GHSA-42cj-m3vj-89wv, the Traefik GitHub commit 26c96a3, and the VulnCheck advisory on the Traefik namespace bypass for release notes and technical background.

Workarounds

Remove all file-provider TCPServersTransport definitions that carry privileged mTLS or SPIFFE material until the upgrade is applied.
Constrain IngressRouteTCP creation using an admission controller policy that rejects serversTransport values containing @file or any non-CRD provider suffix.
Set crossProviderNamespaces to an empty list where cross-provider references are not required, minimizing the blast radius during upgrade windows.

bash

# Gatekeeper-style constraint pseudocode: reject cross-provider TCP transport references
# Apply until Traefik is upgraded to 3.6.23 or 3.7.7
kubectl get ingressroutetcp -A -o json \
  | jq -r '.items[] | select(.spec.routes[]?.services[]?.serversTransport | test("@")) \
  | "\(.metadata.namespace)/\(.metadata.name)"'