CVE-2026-41174

[CVE catalog]

Severity

Medium · CVSS 6.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Published

Apr 30, 2026, 8:20:29 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.25% · Oct 25, 2026

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. When the Kubernetes Custom Resource Definition (CRD) provider's allowCrossNamespace setting is false, Traefik incorrectly processes nested middleware references. An attacker with permissions to create or update Traefik CRDs in their own namespace can exploit this to bypass the intended cross-namespace isolation, allowing Traefik to apply middleware objects from other namespaces. This could lead to unauthorized access or manipulation of resources across namespaces. Traefik: github.com/traefik/traefik: Traefik: Cross-namespace isolation bypass via nested middleware references The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.