CVE-2026-71325

4.8 mediumEPSS 0.2%

Medium (4.8) in traefik traefik. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in github.com/traefik/traefik/v2 2.11.54.

Traefik is an open-source edge router that makes publishing services a fun and easy experience. Prior to 2.11.54, 3.6.25, and 3.7.10, cross-namespace @kubernetescrd references are not rejected for TraefikService backend references resolved by the service resolver. A tenant confined by RBAC to a single namespace can therefore bind its own router to a TraefikService owned by another namespace and expose or reroute that namespace's backend, defeating the namespace isolation allowCrossNamespace=false is meant to enforce. This issue is fixed in version 2.11.54, 3.6.25, 3.7.10.

Severity

CVSS 4.0

4.8 medium

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

4.4 medium

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 4% of CVEs (scores of 2026-10-31)
CWEs: CWE-653, CWE-863
Published: 2026-08-06
Modified: 2026-09-16
Record from: the NVD, synced 2026-10-19

Affected

traefik:traefik

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-62fc-8686-hfmq	Go	github.com/traefik/traefik/v2	<2.11.54	2.11.54
GHSA-62fc-8686-hfmq	Go	github.com/traefik/traefik/v3	>=3.0.0 <3.6.25	3.6.25
GHSA-62fc-8686-hfmq	Go	github.com/traefik/traefik/v3	>=3.7.0 <3.7.10	3.7.10
GHSA-62fc-8686-hfmq	Go	github.com/traefik/traefik	<=1.7.34	no fix published
GO-2026-6203	Go	github.com/traefik/traefik	all versions	no fix published
GO-2026-6203	Go	github.com/traefik/traefik/v2	<2.11.54	2.11.54
GO-2026-6203	Go	github.com/traefik/traefik/v3	>=3.0.0 <3.6.25 >=3.7.0 <3.7.10	3.6.25, 3.7.10

References

Check your stack JSON