CVE-2026-71325
Description
A flaw was found in Traefik. This flaw allows a tenant, even when restricted by Role-Based Access Control (RBAC) to a single namespace, to bypass namespace isolation. By binding their own router to a TraefikService in another namespace, an attacker can expose or reroute that namespace's backend services. This defeats the intended allowCrossNamespace=false enforcement, leading to unauthorized access or manipulation of services across namespaces.
Statement
A flaw in Traefik's service resolver allows a lower-privileged tenant to reference and bind cross-namespace TraefikService objects via @kubernetescrd, even when allowCrossNamespace=false is configured. By creating a custom router targeting an isolated TraefikService CRD in a separate namespace, an authenticated attacker can bypass namespace isolation controls, intercepting or rerouting backend service traffic across multi-tenant boundaries.
Mitigation
To mitigate this flaw, restrict RBAC permissions to prevent non-administrative users from creating or modifying custom Traefik IngressRoute and TraefikService Custom Resource Definitions (CRDs). Alternatively, segregate sensitive backend workloads into dedicated Traefik ingress controller instances.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.7 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Changed | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | Low | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity; Bypass Protection Mechanism
The exploitation of a weakness in low-privileged areas of the software can be leveraged to reach higher-privileged areas without having to overcome any additional obstacles.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
