{"uuid": "024ddd29-eab0-4108-9560-cac011ea36da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-42cj-m3vj-89wv", "type": "seen", "source": "https://gist.github.com/alon710/8d9bdd08d5f9d0638cb7af9de6c94fc7", "content": "# CVE-2026-65602: CVE-2026-65602: IngressRouteTCP ServersTransport Namespace Bypass in Traefik\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-65602\n\n## Summary\nAn authorization bypass vulnerability in Traefik allows low-privileged users within unauthorized Kubernetes namespaces to reference privileged file-provider TCP serversTransports via IngressRouteTCP resources, bypassing the crossProviderNamespaces constraint.\n\n## TL;DR\nTraefik fails to validate the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport configurations, enabling cross-provider namespace bypass.\n\n## Technical Details\n\n- **CWE ID**: CWE-863 (Incorrect Authorization)\n- **Attack Vector**: Network (Remote)\n- **CVSS v4.0**: 5.3 (Medium)\n- **Impact Type**: Subsequent System Integrity and Confidentiality (High)\n- **Exploit Status**: No public weaponized exploits or active exploitation reported\n- **Mitre ATT&CK Technique**: T1068 (Exploitation for Privilege Escalation)\n\n## Affected Systems\n\n- Traefik reverse proxy deployments running within Kubernetes clusters using IngressRouteTCP CRDs.\n- **Traefik**: >= 3.6.0, <= 3.6.22 (Fixed in: `3.6.23`)\n- **Traefik**: >= 3.7.0, <= 3.7.6 (Fixed in: `3.7.7`)\n\n## Mitigation\n\n- Enforce explicit crossProviderNamespaces restrictions in static configurations.\n- Perform periodic scans on custom resource definitions to identify unauthorized provider suffixes.\n- Segregate administrative and untrusted workloads into isolated Kubernetes cluster deployments.\n\n**Remediation Steps:**\n1. Identify the current active Traefik deployment version.\n2. Upgrade to Traefik v3.6.23 or v3.7.7 depending on the active branch.\n3. Verify the static configuration explicitly includes the crossProviderNamespaces list containing only trusted namespaces.\n4. Run the kubectl diagnostic command to audit active IngressRouteTCP resources.\n\n## References\n\n- [GHSA-42cj-m3vj-89wv: Traefik IngressRouteTCP ServersTransport Namespace Bypass](https://github.com/traefik/traefik/security/advisories/GHSA-42cj-m3vj-89wv)\n- [Official Fix Commit](https://github.com/traefik/traefik/commit/67501cbe7bc7774e26ecbd1c29af97f098e14b0b)\n- [Official Preparation Commit](https://github.com/traefik/traefik/commit/26c96a3935cafb473f4a5bae1886560d9aa4e4f0)\n- [Official Release Information (v3.6.23)](https://github.com/traefik/traefik/releases/tag/v3.6.23)\n- [Official Release Information (v3.7.7)](https://github.com/traefik/traefik/releases/tag/v3.7.7)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/traefik-before-ingressroutetcp-serverstransport-namespace-bypass)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-65602) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T00:00:18.191083Z"}