{"id":"EUVD-2026-47646","enisaUuid":"75fb763e-3d45-34a5-bf28-f0a90d657326","description":"Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references (the allowlist was only enforced for HTTP serversTransport references). A low-privileged Kubernetes user in a namespace not listed in crossProviderNamespaces can set serversTransport: foo@file on an IngressRouteTCP service, causing Traefik to accept the forbidden cross-provider reference and use a file-provider TCPServersTransport — including privileged backend mTLS client certificates, SPIFFE identity, or PROXY-protocol settings. This is fixed in 3.6.23 and 3.7.7.","datePublished":"Jul 22, 2026, 11:21:48 AM","dateUpdated":"Oct 8, 2026, 3:23:55 PM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","references":"https://github.com/traefik/traefik/security/advisories/GHSA-42cj-m3vj-89wv\nhttps://github.com/traefik/traefik/commit/26c96a3935cafb473f4a5bae1886560d9aa4e4f0\nhttps://www.vulncheck.com/advisories/traefik-before-ingressroutetcp-serverstransport-namespace-bypass\n","aliases":"CVE-2026-65602\nGHSA-7m3p-wc52-rmc6\nGHSA-42cj-m3vj-89wv\n","assigner":"VulnCheck","epss":0.33,"enisaIdProduct":[{"id":"6ad35e5f-f9b7-35b1-9e1e-51bc8b7c391d","product":{"name":"traefik","vendor":{"name":"traefik"}},"product_version":"3.6.0 \u003c3.6.23"},{"id":"efd0d842-ccb8-374e-a3ba-8d03ab0c6ae7","product":{"name":"traefik","vendor":{"name":"traefik"}},"product_version":"3.7.0 \u003c3.7.7"}],"enisaIdVendor":[{"id":"257c95cc-b562-367d-86f8-34e1794ff5e0","vendor":{"name":"traefik"}}],"enisaIdVulnerability":[{"id":"4e1bf4ac-5fb9-3800-9c80-5934094cd261","vulnerability":{"id":"GHSA-42cj-m3vj-89wv","description":"Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass","datePublished":"Aug 5, 2026, 9:53:35 PM","dateUpdated":"Aug 5, 2026, 9:53:35 PM","baseScore":0.0,"references":"https://github.com/traefik/traefik/security/advisories/GHSA-42cj-m3vj-89wv\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-65602\nhttps://github.com/traefik/traefik/pull/13458\nhttps://github.com/traefik/traefik/commit/67501cbe7bc7774e26ecbd1c29af97f098e14b0b\nhttps://github.com/traefik/traefik\nhttps://github.com/traefik/traefik/releases/tag/v3.6.23\nhttps://github.com/traefik/traefik/releases/tag/v3.7.7\nhttps://www.vulncheck.com/advisories/traefik-before-ingressroutetcp-serverstransport-namespace-bypass\n","enisa_id":"EUVD-2026-47646\n","aliases":"CVE-2026-65602\nGHSA-42cj-m3vj-89wv\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:59:06 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b996470f-a99e-36d5-bcf3-e3dfb32c586c","vulnerability":{"id":"CVE-2026-65602","description":"Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references (the allowlist was only enforced for HTTP serversTransport references). A low-privileged Kubernetes user in a namespace not listed in crossProviderNamespaces can set serversTransport: foo@file on an IngressRouteTCP service, causing Traefik to accept the forbidden cross-provider reference and use a file-provider TCPServersTransport — including privileged backend mTLS client certificates, SPIFFE identity, or PROXY-protocol settings. This is fixed in 3.6.23 and 3.7.7.","datePublished":"Jul 22, 2026, 11:21:48 AM","dateUpdated":"Oct 8, 2026, 3:23:55 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","references":"https://github.com/traefik/traefik/security/advisories/GHSA-42cj-m3vj-89wv\nhttps://github.com/traefik/traefik/commit/26c96a3935cafb473f4a5bae1886560d9aa4e4f0\nhttps://www.vulncheck.com/advisories/traefik-before-ingressroutetcp-serverstransport-namespace-bypass\n","enisa_id":"EUVD-2026-47646\n","assigner":"VulnCheck","epss":0.33,"dataProcessed":"Oct 30, 2026, 7:16:23 AM","vulnerabilityProduct":[{"id":"4d17299f-3049-3926-b19e-dc885271a194","product":{"name":"traefik","vendor":{"name":"traefik"}},"product_version":"3.6.0 \u003c3.6.23"},{"id":"5d656715-90a6-3e00-ba40-3b2e73fe2918","product":{"name":"traefik","vendor":{"name":"traefik"}},"product_version":"3.7.0 \u003c3.7.7"}],"vulnerabilityVendor":[{"id":"93d604d6-a03b-3306-89ef-8f8351dd188f","vendor":{"name":"traefik"}}]}},{"id":"e7c6e374-e9ac-3742-aee4-061406bde747","vulnerability":{"id":"GHSA-7m3p-wc52-rmc6","description":"Duplicate Advisory: Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass","datePublished":"Jul 22, 2026, 12:32:18 PM","dateUpdated":"Aug 5, 2026, 9:51:05 PM","baseScore":0.0,"references":"https://github.com/traefik/traefik/security/advisories/GHSA-42cj-m3vj-89wv\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-65602\nhttps://github.com/traefik/traefik/commit/26c96a3935cafb473f4a5bae1886560d9aa4e4f0\nhttps://www.vulncheck.com/advisories/traefik-before-ingressroutetcp-serverstransport-namespace-bypass\n","enisa_id":"EUVD-2026-47646\n","aliases":"GHSA-7m3p-wc52-rmc6\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:58:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}