CVE-2026-65602

score

0.1

cvss

8.8

epss

0.3%

published

2026-07-22

kev added

—

first seen

2026-10-21

Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 contain a broken access control vulnerability caused by failure to enforce crossProviderNamespaces allowlist for IngressRouteTCP serversTransport references, letting low-privileged Kubernetes users in unauthorized namespaces use privileged backend TCPServersTransport settings, exploit requires low-privileged Kubernetes user access.