4.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41174

CVE-2026-41174: Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a potential vulnerability in Traefik's Kubernetes CRD provider cross-namespace isolation enforcement. When providers.kubernetesCRD.allowCrossNamespace=false, Traefik correctly rejects direct cross-namespace middleware references from IngressRoute objects, but fails to apply the same restriction to middleware references nested inside a Chain middleware's spec.chain.middlewares[]. An actor with permission to create or update Traefik CRDs in their own namespace can exploit this to cause Traefik to resolve and apply middleware objects from another namespace, bypassing the documented isolation boundary. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41174

CVE-2026-41174:

4.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/traefik/traefik/v3	go	>= 3.7.0-ea.1, < 3.7.0-rc.2	3.7.0-rc.2
github.com/traefik/traefik/v3	go	>= 3.0.0-beta1, < 3.6.14	3.6.14
github.com/traefik/traefik/v2	go	< 2.11.43	2.11.43
github.com/traefik/traefik	go	<= 1.7.34

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in Traefik's Kubernetes CRD provider, where the allowCrossNamespace=false setting was not being honored for Chain middlewares. This allowed an attacker with permissions to create Traefik CRDs in one namespace to reference and use middlewares from another namespace, bypassing the intended isolation boundary.

The root cause was in the createChainMiddleware function in pkg/provider/kubernetes/crd/kubernetes.go. This function was responsible for resolving the middlewares listed in a Chain's specification. However, it did not have a mechanism to check whether cross-namespace references were permitted. It would unconditionally resolve the namespace from the middleware reference or default to the Chain's own namespace.

The function loadConfigurationFromCRD, which is responsible for loading the configuration from CRDs, called createChainMiddleware without passing the necessary allowCrossNamespace context.

The patch addresses this by modifying the signature of createChainMiddleware to accept the allowCrossNamespace boolean. Inside the function, new logic was added to check this flag and return an error if a cross-namespace reference is attempted when it's disallowed. Consequently, the call to createChainMiddleware within loadConfigurationFromCRD was updated to pass the provider's AllowCrossNamespace setting, effectively closing the security gap.

Vulnerable functions

createChainMiddleware

pkg/provider/kubernetes/crd/kubernetes.go

This function is responsible for creating a chain of middlewares. The vulnerability lies in the fact that this function did not previously check whether cross-namespace middleware referencing was allowed. An attacker could create a `Chain` middleware that references a middleware in another namespace, and Traefik would resolve and apply it, bypassing the `allowCrossNamespace=false` restriction. The patch added the `allowCrossNamespace` parameter and logic to enforce this restriction.

loadConfigurationFromCRD

pkg/provider/kubernetes/crd/kubernetes.go

This function loads the entire dynamic configuration from Kubernetes Custom Resource Definitions (CRDs). It calls `createChainMiddleware` to build the middleware chains. Before the patch, it called the vulnerable version of `createChainMiddleware` without passing the `allowCrossNamespace` setting. The patch modifies this function to pass the `p.AllowCrossNamespace` value to `createChainMiddleware`, ensuring that the cross-namespace restriction is enforced.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.