Traefik's Kubernetes CRD provider enforcement of cross‑namespace isolation fails to protect nested Chain middlewares. When the allowCrossNamespace flag is set to false, the system still resolves middleware objects referenced within a Chain's spec.chain.middlewares[] from any namespace. An attacker with permission to create or update CRDs in their own namespace can thus cause Traefik to apply middleware defined in a different namespace, thereby bypassing the intended isolation boundary. This flaw enables an actor to inject unintended routing behavior, potentially exposing services, rerouting traffic, or executing other malicious middleware logic across namespaces.

All Traefik releases prior to 2.11.43, 3.6.14, and 3.7.0‑rc.2 are affected. This includes the v2.11.x and v3.6.x series, as well as early v3.7.0‑rc releases. The issue is specific to the Kubernetes CRD provider and impacts any cluster configuration that uses the providers.kubernetesCRD.allowCrossNamespace setting set to false.

The CVSS score is 4.8, indicating a moderate severity. The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have CRD creation or update rights within their own namespace, which is a privileged action within a Kubernetes cluster. Once those rights are present, the attacker can bind chain middlewares to references in other namespaces, bypassing the namespace isolation. This raises concerns for environments that grant broad CRD permissions, especially in multi‑tenant cluster setups.