CVE-2026-71325

Executive Summary

CVE-2026-71325 is an authorization bypass vulnerability in Traefik, the popular open-source edge router and reverse proxy. Prior to versions 2.11.54, 3.6.25, and 3.7.10, Traefik fails to reject cross-namespace @kubernetescrd references for TraefikService backend references resolved by the service resolver. This flaw allows a tenant confined by Kubernetes RBAC to a single namespace to bind its own router to a TraefikService owned by another namespace, effectively bypassing the namespace isolation that the allowCrossNamespace=false setting is designed to enforce. Successful exploitation can expose or reroute backend traffic belonging to other namespaces, undermining multi-tenant cluster security boundaries.

Technical Analysis

The vulnerability resides in Traefik's Kubernetes CRD service resolver logic. Traefik allows users to define IngressRoute resources that reference backend services using the @kubernetescrd notation. The service resolver is responsible for resolving these references and routing traffic to the appropriate backend.

Vulnerability Mechanism:

1. Cross-Namespace Reference Handling: Traefik's configuration supports a global setting, allowCrossNamespace, which when set to false (the default), is intended to prevent cross-namespace references. However, the validation logic only enforces this restriction on certain resource types (e.g., IngressRoute references to Middleware objects) and fails to apply the same check to TraefikService backend references.

2. Reference Resolution Flaw: When a TraefikService is used as a backend in an IngressRoute, and that TraefikService itself references another TraefikService or weighted service in a different namespace, the service resolver does not validate the namespace of the target TraefikService. This allows a user in namespace A to create an IngressRoute that points to a TraefikService in namespace B via a chain of references.

3. RBAC Bypass: In a multi-tenant Kubernetes cluster, tenants are typically confined to their own namespace via RBAC. An attacker with access to their own namespace can create IngressRoute and TraefikService resources that reference resources in other namespaces, bypassing the intended isolation.

Attack Surface:

• Multi-tenant Kubernetes clusters running Traefik as an ingress controller.
• Deployments where namespace isolation is a security boundary (e.g., SaaS platforms, shared clusters).
• Configurations using allowCrossNamespace=false (default) where operators assume cross-namespace references are blocked.

Code-Level Detail: The flaw is in the Kubernetes CRD provider's loadConfigurationFromCRD function. When iterating over IngressRoute and TraefikService objects, the resolver builds a map of references. For Middleware references, a check against allowCrossNamespace is performed. However, a similar check for TraefikService backend references is missing or incomplete, allowing the reference chain to span namespaces without triggering the guard condition.

Exploitation Scenarios

Prerequisites:

• Attacker has RBAC access to a namespace (e.g., tenant-a) in a multi-tenant cluster.
• Traefik CRD provider is enabled and the IngressRoute custom resource is in use.
• Traefik installed in the cluster has a version prior to 2.11.54, 3.6.25, or 3.7.10.
• The cluster uses allowCrossNamespace=false (default) — the attacker bypasses this safeguard.

Attack Chain:

1. Reconnaissance:

   • The attacker enumerates namespaces and identifies TraefikService resources owned by other tenants. Using kubectl (if RBAC allows list of traefikservices across namespaces) or by guessing common names, the attacker targets a TraefikService in namespace admin-svc that routes to an internal admin dashboard or backend API.

2. Weaponization:

   • The attacker creates a TraefikService in their own namespace (tenant-a) that defines a weighted or mirroring service referencing the victim's TraefikService using the format victim-namespace@kubernetescrd:

     apiVersion: traefik.containo.us/v1alpha1
     kind: TraefikService
     metadata:
       name: pivoted-svc
       namespace: tenant-a
     spec:
       weighted:
         services:
           - name: admin-dashboard@kubernetescrd
             namespace: admin-svc
             port: 80
             weight: 1
     

   • Alternatively, the attacker directly defines an IngressRoute in their namespace that references the cross-namespace TraefikService:

     apiVersion: traefik.containo.us/v1alpha1
     kind: IngressRoute
     metadata:
       name: evil-route
       namespace: tenant-a
     spec:
       entryPoints:
         - web
       routes:
         - match: Host(`evil.attacker.com`)
           kind: Rule
           services:
             - name: admin-dashboard@kubernetescrd
               namespace: admin-svc
               port: 80
     

   • Note: The namespace field in the service reference is honored by the resolver, but the allowCrossNamespace check is not applied to this reference path.

3. Payload Execution:

   • The attacker applies the resource via kubectl apply -f malicious-ingressroute.yaml to their namespace.
   • Traefik's controller reconciles the changes, resolves the TraefikService reference, and creates a route that matches the attacker's host header (e.g., evil.attacker.com).
   • The route forwards traffic to the TraefikService in admin-svc namespace.

4. Post-Exploitation Impact:

   • The attacker can now reach the admin dashboard or backend service of another tenant.
   • If the victim's backend exposes sensitive endpoints (e.g., admin metrics, internal APIs, databases), the attacker can exfiltrate data.
   • The attacker can also use the compromised route to perform server-side request forgery (SSRF) against internal Kubernetes services, the Kubernetes API server, or cloud metadata endpoints (e.g., 169.254.169.254), potentially escalating privileges.

Alternative Scenario (Traffic Rerouting):

• The attacker can modify a referenced TraefikService in their namespace to act as a proxy or load balancer that mirrors all traffic to both the legitimate backend and a server they control, enabling passive data exfiltration of sensitive traffic without disrupting the victim's service availability.

Impact Assessment

Business Impact: High. This vulnerability breaks the trust boundary in multi-tenant Kubernetes environments. An attacker can access internal services, sensitive data, and administrative interfaces of other tenants, violating confidentiality and potentially integrity (if the attacker can modify backend responses or route manipulations).

CVSS Subscores (if scored): Even without an official CVSS vector, the vulnerability's characteristics — network-adjacent attack vector, low attack complexity, low privileges required (single namespace access), high confidentiality and integrity impact — would likely place it in the 8.0–9.5 range (High to Critical).

Affected Systems:

• All Traefik deployments running versions < 2.11.54, < 3.6.25, and < 3.7.10 with the Kubernetes CRD provider enabled.
• Multi-tenant clusters where namespace separation is the primary isolation mechanism.

Blast Radius: Moderate to High. The exploit is limited to clusters using the CRD provider with TraefikService references. However, in affected clusters, all namespaces are potentially at risk. The exploit requires authenticated access to the cluster (a valid kubeconfig and RBAC to create resources in at least one namespace), which is a common baseline in shared clusters. Once exploited, lateral movement or privilege escalation within the cluster is highly probable.

Detection Guidance

Sigma Rule

title: Traefik Cross-Namespace Kubernetes CRD Reference Anomaly
id: 9c5b3f2e-7d1a-4e8b-9c6f-2a1b3c4d5e6f
status: experimental
description: Detects Kubernetes API requests creating or updating IngressRoute or TraefikService resources with cross-namespace references that violate allowCrossNamespace=false.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-71325
author: Threat Intelligence Team
date: 2026/06/15
logsource:
    product: kubernetes
    service: audit
detection:
    selection:
        verb: ["create", "update", "patch"]
        objectRef.resource: ["ingressroutes", "traefikservices"]
        objectRef.apiGroup: "traefik.containo.us"
    filter_cross_namespace:
        # This filter is a placeholder; actual detection requires parsing the requestObject for
        # namespace fields that differ from objectRef.namespace and contain "@kubernetescrd"
        requestObject.spec.routes.services.namespace|re: ".*"
        requestObject.spec.routes.services.name|contains: "@kubernetescrd"
    condition: selection and filter_cross_namespace
level: high
falsepositives:
    - Legitimate cross-namespace references if allowCrossNamespace is explicitly set to true
    - Internal automation that manages resources across namespaces with proper authorization

YARA Rule

rule Detect_Traefik_CrossNamespace_Config
{
    meta:
        author = "Threat Intel - valtersit.com"
        description = "Detect Kubernetes YAML or JSON manifests containing TraefikService references with cross-namespace @kubernetescrd patterns"
        cve = "CVE-2026-71325"
        date = "2026-06-15"
        severity = "high"
    strings:
        $cr = "@kubernetescrd" ascii nocase
        $ns_field = "namespace:" ascii nocase
        $ns_field_alt = '"namespace":' ascii nocase
        $traefik_service = "TraefikService" ascii nocase
        $ingress_route = "IngressRoute" ascii nocase
    condition:
        $cr and ($traefik_service or $ingress_route) and (1 of ($ns_field*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-71325 Traefik Cross-Namespace CRD Exploitation Attempt"; flow:established,to_server; content:"@kubernetescrd"; nocase; http.uri; pcre:"/(ingressroute|traefikservice)/i"; content:"namespace"; nocase; http.uri; sid:202671325; rev:1; metadata:created_at 2026_06_15, updated_at 2026_06_15, cve CVE-2026-71325, severity high, deployment alerting;)

Elastic Detection

sequence by host.name, user.name with maxspan=5m
  [any where process.name : "kubectl*" and process.args : ("apply", "create", "patch") and process.args : ("*ingressroute*", "*traefikservice*")]
  [any where kubernetes.audit.objectRef.resource : ("ingressroutes", "traefikservices") and kubernetes.audit.verb : ("create", "update", "patch") and kubernetes.audit.requestObject : "*@kubernetescrd*"]

Splunk SPL Query

index=kubernetes sourcetype=kube:audit
(verb=create OR verb=update OR verb=patch)
objectRef.resource=ingressroutes OR objectRef.resource=traefikservices
objectRef.apiGroup="traefik.containo.us"
| spath input=requestObject output=refs.path spec.routes.services{}.name
| search refs.path="*@kubernetescrd*"
| spath input=requestObject output=ref_ns spec.routes.services{}.namespace
| where ref_ns != objectRef.namespace
| stats count by user.username, sourceIP, objectRef.namespace, ref_ns, objectRef.name

Wazuh OSSEC Rule

<group name="kubernetes,">
  <rule id="100325" level="12">
    <decoded_as>json</decoded_as>
    <field name="objectRef.resource">ingressroutes|traefikservices</field>
    <field name="objectRef.apiGroup">traefik.containo.us</field>
    <field name="verb">create|update|patch</field>
    <regex>.*@kubernetescrd.*</regex>
    <description>Detected potential CVE-2026-71325 exploitation: cross-namespace TraefikService reference in IngressRoute/TraefikService creation or update.</description>
    <group>traefik_cve_2026_71325,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source (NVD) claims patch (not independently confirmed).)

1. Immediate Mitigations (before patching):

• Restrict RBAC: Temporarily tighten RBAC policies to prevent non-admin users from creating or modifying traefik.containo.us CRDs (including IngressRoute and TraefikService). This is a blocking action but may disrupt legitimate workflows.
• Enable Admission Controllers: Deploy a Kubernetes ValidatingAdmissionWebhook (e.g., using OPA Gatekeeper or Kyverno) that rejects any IngressRoute or TraefikService containing a reference with @kubernetescrd whose namespace field differs from the resource's own namespace. This provides a defense-in-depth layer without requiring a Traefik restart.
• Network Segmentation: Use NetworkPolicies to restrict egress traffic from Traefik's pod to only the intended backend namespaces, potentially limiting the blast radius if exploitation occurs.

2. Patch/Upgrade Steps:

• Upgrade Traefik to one of the fixed versions:
  • v2.x branch: Upgrade to v2.11.54 or later.
  • v3.x branch: Upgrade to v3.6.25 or v3.7.10 or later.
• Upgrade Method:
  • For Helm deployments: helm upgrade traefik traefik/traefik --version <fixed-version>
  • For raw manifests: Update the container image tag (e.g., traefik:v3.7.10) and re-apply the deployment manifest.
• Post-Upgrade Verification: After upgrade, verify the state of all IngressRoute and TraefikService resources. Run a reconciliation script to identify and flag any existing cross-namespace references for review.

3. Long-Term Hardening:

• Enable allowCrossNamespace: false (already default) and validate via a config audit script that no legitimate resource relies on cross-namespace references.
• Adopt Policy-as-Code: Integrate OPA Gatekeeper or Kyverno policies into the CI/CD pipeline to prevent any CRD resource with cross-namespace references from being deployed.
• Regular Audits: Conduct periodic Kubernetes audit log reviews to detect anomalous CRD creation patterns.
• Monitor for Patch Confirmation: Track the vendor advisory (Traefik's GitHub release notes for v2.11.54, v3.6.25, v3.7.10) to independently confirm the patch and check for any secondary advisories.

References

1. NVD Entry for CVE-2026-71325: https://nvd.nist.gov/vuln/detail/CVE-2026-71325
2. Traefik Official GitHub (Release Notes for fixed versions): https://github.com/traefik/traefik/releases/tag/v3.7.10
3. Traefik Documentation — Kubernetes CRD and Namespace Isolation: https://doc.traefik.io/traefik/routing/providers/kubernetes-crd/#allowcrossnamespace
4. CWE-653 (Improper Isolation or Compartmentalization): https://cwe.mitre.org/data/definitions/653.html
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-71325 currently not listed; no known in-the-wild exploitation as of this report's date.)

Threat Actor Campaigns: None identified at the time of writing. The vulnerability was disclosed via a security advisory and coordinated with the Traefik maintainers. Enterprises are advised to treat this as a high-risk issue due to its multi-tenant impact profile, even without active exploitation campaigns.