Is there a public PoC exploit available for CVE-2026-65602?

Yes, a public proof-of-concept exploit is available for CVE-2026-65602. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for CVE-2026-65602?

Yes, a patch is available for CVE-2026-65602. Update the affected software to the latest version immediately.

Traefik CVE-2026-65602

Q: What is the CVSS score of CVE-2026-65602?

CVE-2026-65602 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-47646 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-22 VulnCheck

GHSA-42cj-m3vj-89wv

GHSA-7m3p-wc52-rmc6

Kubernetes Authentication Bypass Traefik

5.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Requires non-default crossProviderNamespaces config and low-priv IngressRouteTCP CRD write access (PR:L, AC:H mapping AT:P); scope changes because privileged credentials on subsequent backend systems are misappropriated.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Red Hat

6.4 MEDIUM

qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 22, 2026 - 12:22 vuln.today

Analysis Generated

Jul 22, 2026 - 12:22 vuln.today

DescriptionCVE.org

Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references (the allowlist was only enforced for HTTP serversTransport references). A low-privileged Kubernetes user in a namespace not listed in crossProviderNamespaces can set serversTransport: foo@file on an IngressRouteTCP service, causing Traefik to accept the forbidden cross-provider reference and use a file-provider TCPServersTransport - including privileged backend mTLS client certificates, SPIFFE identity, or PROXY-protocol settings. This is fixed in 3.6.23 and 3.7.7.

AnalysisAI

Authorization bypass in Traefik's IngressRouteTCP handler (versions 3.6.0-3.6.22 and 3.7.0-3.7.6) allows a low-privileged Kubernetes user to reference file-provider TCPServersTransport configurations across namespace boundaries that the crossProviderNamespaces allowlist should block. The allowlist was enforced for HTTP serversTransport references but silently omitted from the equivalent TCP code path, creating an inconsistent and exploitable access boundary. By crafting an IngressRouteTCP resource with serversTransport: foo@file, an attacker causes Traefik to apply privileged backend settings - including mTLS client certificates, SPIFFE workload identities, or PROXY-protocol configuration - belonging to namespaces they are not authorized to access. No public exploit code or CISA KEV listing exists at time of analysis; vendor-released patches are available in 3.6.23 and 3.7.7.

Technical ContextAI

Traefik is a cloud-native reverse proxy and load balancer with first-class Kubernetes support, exposing custom resource definitions including IngressRouteTCP for TCP-level traffic routing. The crossProviderNamespaces feature acts as an RBAC-adjacent allowlist controlling which Kubernetes namespaces may reference resources from alternate Traefik configuration providers - notably the static file provider, which holds TCPServersTransport objects that can embed mTLS client credentials, SPIFFE-based workload identity assertions, and PROXY-protocol forwarding rules. CWE-863 (Incorrect Authorization) precisely describes the root cause: the namespace boundary enforcement was implemented for the HTTP serversTransport resolution path but was absent from the parallel TCP resolution path, creating a logic gap exploitable via the @file provider-scoping syntax (e.g., serversTransport: foo@file). Affected CPE: cpe:2.3:a:traefik:traefik across both 3.6.x and 3.7.x branches. The CVSS 4.0 vector reflects that the vulnerable system (Traefik itself) has no direct CIA impact, but subsequent backend systems face High confidentiality and integrity exposure through misappropriated privileged credentials.

RemediationAI

Upgrade to Traefik 3.6.23 (for the 3.6.x branch) or 3.7.7 (for the 3.7.x branch), which enforce the crossProviderNamespaces allowlist consistently for both HTTP and TCP serversTransport references, as confirmed by vendor security advisory GHSA-42cj-m3vj-89wv at https://github.com/traefik/traefik/security/advisories/GHSA-42cj-m3vj-89wv and fix commit at https://github.com/traefik/traefik/commit/26c96a3935cafb473f4a5bae1886560d9aa4e4f0. If immediate upgrade is not feasible, restrict Kubernetes RBAC so that untrusted users cannot create or modify IngressRouteTCP resources in namespaces excluded from crossProviderNamespaces - this removes the prerequisite for exploitation but may disrupt self-service ingress provisioning patterns in developer-facing clusters. As a secondary compensating control, audit all existing IngressRouteTCP resources for serversTransport fields containing the @file suffix (e.g., grep for '@file' across IngressRouteTCP manifests) and remove any unauthorized cross-provider references; this addresses existing misconfigurations but not future ones without the RBAC restriction. Neither workaround fully substitutes for patching.