Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a potential vulnerability in Traefik's Kubernetes CRD provider cross-namespace isolation enforcement. When providers.kubernetesCRD.allowCrossNamespace=false, Traefik correctly rejects direct cross-namespace middleware references from IngressRoute objects, but fails to apply the same restriction to middleware references nested inside a Chain middleware's spec.chain.middlewares[]. An actor with permission to create or update Traefik CRDs in their own namespace can exploit this to cause Traefik to resolve and apply middleware objects from another namespace, bypassing the documented isolation boundary. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2,
    there is a potential vulnerability in Traefik's Kubernetes CRD provider cross-namespace isolation
    enforcement. When providers.kubernetesCRD.allowCrossNamespace=false, Traefik correctly rejects direct
    cross-namespace middleware references from IngressRoute objects, but fails to apply the same restriction
    to middleware references nested inside a Chain middleware's spec.chain.middlewares[]. An actor with
    permission to create or update Traefik CRDs in their own namespace can exploit this to cause Traefik to
    resolve and apply middleware objects from another namespace, bypassing the documented isolation boundary.
    This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2. (CVE-2026-41174)

The version of Traefik installed on the remote macOS host is prior to 2.11.43 or 3.x prior to 3.6.14. It is, therefore, affected by multiple vulnerabilities:

  - An authentication bypass via StripPrefixRegex and ForwardAuth dot-segment normalization. When StripPrefixRegex     processes URLs with percent-encoded characters, it miscalculates byte offsets, producing a dot-segment path that     authentication middleware fails to match against protection rules. (CVE-2026-40912)

  - An authentication bypass via unsanitized underscore-variant forwarded headers. Traefik's forwarded-header     sanitization logic targets only canonical header names and does not strip alias variants that use underscores     instead of dashes, allowing attackers to inject forged trust context to bypass ForwardAuth. (CVE-2026-39858)

  - An authentication bypass in ForwardAuth when trustForwardHeader is set to false behind a trusted proxy. The     X-Forwarded-Prefix header remains unstripped in authentication subrequests, allowing external attackers to     spoof the header and bypass access controls on protected routes. (CVE-2026-35051)

  - A timing side-channel in BasicAuth that allows username enumeration via bcrypt short-circuit. Due to a map     key/value confusion bug, a fallback security mechanism fails to function properly, enabling attackers to     enumerate valid usernames by analyzing response-time differences. (CVE-2026-41263)

  - A Kubernetes CRD cross-namespace isolation bypass via Chain middleware references. When     allowCrossNamespace is set to false, Traefik fails to apply the same restriction to middleware references     nested inside a Chain middleware, allowing actors to access middleware from other namespaces. (CVE-2026-41174)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
441338	SCA: security update for github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 (GHSA-xhjw-95fp-8vgq)	Tenable Cloud Security	SCA Checks	Local	medium
441338	SCA: security update for github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 (GHSA-xhjw-95fp-8vgq)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
311474	Traefik < 2.11.43 / 3.x < 3.6.14 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Local	high

Detections

Analytics

CVE-2026-41174

medium

Tenable Plugins

medium

medium

high