CyberRota Analysis
AI-GeneratedKubernetes deployments using Traefik versions prior to 2.11.54, 3.6.25, and 3.7.10 are vulnerable to cross-namespace references, allowing a tenant restricted by RBAC to access and manipulate services in other namespaces. This vulnerability undermines namespace isolation, potentially exposing sensitive backend services to unauthorized access or rerouting. Organizations utilizing Traefik in their Kubernetes environments should prioritize upgrading to the patched versions to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Traefik is an open-source edge router that makes publishing services a fun and easy experience. Prior to 2.11.54, 3.6.25, and 3.7.10, cross-namespace @kubernetescrd references are not rejected for TraefikService backend references resolved by the service resolver. A tenant confined by RBAC to a single namespace can therefore bind its own router to a TraefikService owned by another namespace and expose or reroute that namespace's backend, defeating the namespace isolation allowCrossNamespace=false is meant to enforce. This issue is fixed in version 2.11.54, 3.6.25, 3.7.10.