Listen to this Post
How CVE-2026-71325 Works
Traefik’s Kubernetes CRD provider uses the `providers.kubernetesCRD.allowCrossNamespace` setting to enforce namespace isolation. When this setting is `false` (the default), cross-namespace `@kubernetescrd` references are supposed to be rejected for all resource types. This isolation is correctly enforced for middlewares, TLS options, and HTTP/TCP ServersTransports.
However, the `TraefikService` backend references follow a different code path and were never given the same guard. The vulnerable function `configBuilder.nameAndService` (in pkg/provider/kubernetes/crd/kubernetes_http.go) only performs the same-namespace check for names without an `@` separator. For names that contain an `@` separator (e.g., victim-backend@kubernetescrd), it only applies the `crossProviderNamespaces` allowlist check. By default, this allowlist is nil, which the `isCrossProviderNamespaceAllowed` function interprets as “unrestricted”. It never applies the `!allowCrossNamespace && strings.HasSuffix(name, “@kubernetescrd”)` rejection that is present in all other sibling resolvers.
As a result, a Kubernetes tenant confined by RBAC to their own namespace can bind their own router to a `TraefikService` owned by another namespace simply by referencing it as <victim-namespace>-<name>@kubernetescrd. At runtime, the attacker’s route forwards traffic to the victim’s backend pods, defeating the namespace isolation that `allowCrossNamespace=false` is meant to enforce. This vulnerability affects all Traefik v2 releases and unmaintained v3 minor lines below v3.6.
DailyCVE Form
Platform: Kubernetes
Version: <=2.11.53, <=3.6.24, 3.7.0-3.7.9
Vulnerability: Namespace isolation bypass
Severity: Medium
date: 2026-08-03
Prediction: 2026-08-06
What Undercode Say: Analytics
The vulnerability resides in the `nameAndService` function within pkg/provider/kubernetes/crd/kubernetes_http.go. The following is a simplified view of the vulnerable code path:
// pkg/provider/kubernetes/crd/kubernetes_http.go:662-695 — nameAndService (VULNERABLE)
func (c configBuilder) nameAndService(ctx context.Context, parentNamespace string, service traefikv1alpha1.LoadBalancerSpec) (string, dynamic.Service, error) {
// ...
if !strings.Contains(service.Name, providerNamespaceSeparator) {
// This branch handles names WITHOUT "@" and correctly enforces allowCrossNamespace
// ...
if !isNamespaceAllowed(c.allowCrossNamespace, parentNamespace, service.Namespace) {
return "", nil, fmt.Errorf("service %s/%s not in the parent resource namespace %s", ...)
}
}
// For names WITH "@", the ONLY gate is crossProviderNamespaces, which defaults to allow-all (nil).
if !isCrossProviderNamespaceAllowed(c.crossProviderNamespaces, parentNamespace) && strings.Contains(service.Name, providerNamespaceSeparator) {
return "", nil, fmt.Errorf("service %q reference is not allowed: ...", service.Name)
}
// ^-- MISSING: no `!c.allowCrossNamespace && strings.HasSuffix(service.Name, "@"+ProviderName)` rejection.
switch service.Kind {
case "TraefikService":
return fullServiceName(svcCtx, service, intstr.FromInt(0)), nil, nil // Returns the cross-namespace reference
// ...
}
}
In contrast, the `resolveReference` function correctly enforces the guard for middlewares and TLS options:
// pkg/provider/kubernetes/crd/kubernetes.go:1653-1668 — resolveReference (CORRECT)
func resolveReference(ctx context.Context, parentNs, ns, name string, crossProviderNamespaces []string, allowCrossNamespace bool) (string, error) {
if strings.Contains(name, providerNamespaceSeparator) {
if !allowCrossNamespace && strings.HasSuffix(name, providerNamespaceSeparator+ProviderName) {
return "", errors.New("when allowCrossNamespace is disabled, @kubernetescrd references are disallowed") // THE GUARD
}
// ...
}
// ...
}
The Proof of Concept (PoC) demonstrates the bypass:
$ go test -run TestPoC_CrossNamespaceServiceBypass ./pkg/provider/kubernetes/crd/ -v HTTP routers: [attacker-attacker-svc-route-7df4381938699bd21215] HTTP services: [victim-whoami-victim-80 victim-backend] CONTROL OK: cross-ns MIDDLEWARE ref (victim-mw@kubernetescrd) rejected -> router dropped BYPASS CONFIRMED: attacker router bound to cross-ns service "victim-backend" despite AllowCrossNamespace=false
Exploit
An attacker with namespace-scoped RBAC to create `IngressRoute` or `TraefikService` resources in their own namespace can exploit this vulnerability. The attacker only needs knowledge of the target TraefikService‘s namespace and name. By creating an `IngressRoute` that references the victim’s service using the `@kubernetescrd` syntax, the attacker’s router is bound to the victim’s backend.
Protection
Upgrade to a patched version of Traefik:
- v2.11.54 or later
- v3.6.25 or later
- v3.7.10 or later
For users on unmaintained v3 minor lines below v3.6, upgrading to a maintained, patched release is the only remedy.
Impact
In a multi-tenant cluster relying on `allowCrossNamespace=false` for namespace isolation, a tenant confined to their own namespace can attach their own router (with their own `Host` rule and entrypoint) to another tenant’s `TraefikService` backend. This exposes an otherwise internal-only service on the data plane under the attacker’s hostname, and allows the attacker to route or mirror traffic to another namespace’s backend that they should not be able to reference.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
