CVE-2026-71325

[CVE catalog]

Severity

High · CVSS 8.7CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Published

Aug 6, 2026, 4:24:56 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.15% · Oct 25, 2026

A flaw was found in Traefik. This flaw allows a tenant, even when restricted by Role-Based Access Control (RBAC) to a single namespace, to bypass namespace isolation. By binding their own router to a TraefikService in another namespace, an attacker can expose or reroute that namespace's backend services. This defeats the intended `allowCrossNamespace=false` enforcement, leading to unauthorized access or manipulation of services across namespaces. github.com/traefik/traefik: Traefik: Namespace isolation bypass via TraefikService backendRef A flaw in Traefik's service resolver allows a lower-privileged tenant to reference and bind cross-namespace TraefikService objects via @kubernetescrd, even when allowCrossNamespace=false is configured. By creating a custom router targeting an isolated TraefikService CRD in a separate namespace, an authenticated attacker can bypass namespace isolation controls, intercepting or rerouting backend service traffic across multi-tenant boundaries. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.