CVE-2026-65602

[CVE catalog]

Severity

Medium · CVSS 6.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Published

Jul 22, 2026, 11:21:48 AM UTC

Source

[NVD] · [CVE record]

EPSS

0.33% · Oct 25, 2026

A flaw was found in Traefik. A low-privileged Kubernetes user can bypass the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references. By setting a forbidden cross-provider reference, Traefik may use a file-provider TCPServersTransport. This can lead to the exposure of privileged backend mTLS client certificates, SPIFFE identity, or PROXY-protocol settings, resulting in information disclosure and potential integrity compromise. traefik: Traefik: Information disclosure and integrity bypass via IngressRouteTCP cross-provider reference Red Hat OpenShift Dev Spaces ships a version of traefik affected by this vulnerability. The flaw allows a low-privileged Kubernetes user to bypass the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references, potentially exposing privileged backend mTLS client certificates or SPIFFE identity. Exploitation requires specific Kubernetes RBAC permissions and a crossProviderNamespaces configuration with cross-provider TCPServersTransport resources. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.