Description
Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references (the allowlist was only enforced for HTTP serversTransport references). A low-privileged Kubernetes user in a namespace not listed in crossProviderNamespaces can set serversTransport: foo@file on an IngressRouteTCP service, causing Traefik to accept the forbidden cross-provider reference and use a file-provider TCPServersTransport — including privileged backend mTLS client certificates, SPIFFE identity, or PROXY-protocol settings. This is fixed in 3.6.23 and 3.7.7.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| traefik | traefik | 3.6.0 – < 3.6.23, 3.7.0 – < 3.7.7 | 3.6.23 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 | SUSE-SU-2026:23625-1 |
| SLES 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 | SUSE-SU-2026:23625-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 | openSUSE-SU-2026:21761-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/traefik/traefik | all versions | — | GO-2026-6192 |
| Go | github.com/traefik/traefik/v2 | all versions | — | GO-2026-6192 |
| Go | github.com/traefik/traefik/v3 | >= 3.6.0, < 3.6.23 | 3.6.23 | GHSA-42cj-m3vj-89wv |
| Go | github.com/traefik/traefik/v3 | >= 3.7.0, < 3.7.7 | 3.7.7 | GHSA-42cj-m3vj-89wv |
| Go | github.com/traefik/traefik/v3 | >= 3.6.0, < 3.6.23 · >= 3.7.0, < 3.7.7 | 3.6.23, 3.7.7 | GO-2026-6192 |
Advisories 2
- SUSE-SU-2026:23625-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 29, 2026
- openSUSE-SU-2026:21761-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 9, 2026
References
- GitHub Security Advisory (GHSA-42cj-m3vj-89wv) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: Traefik before 3.6.23 IngressRouteTCP ServersTransport Namespace Bypass third-party-advisory