Traefik versions from 3.6.0 up to 3.6.22 and from 3.7.0 to 3.7.6 do not enforce the crossProviderNamespaces allowlist for IngressRouteTCP serversTransport references, allowing a low‑privileged Kubernetes user in an unlisted namespace to reference a file provider and cause Traefik to load privileged backend mTLS certificates, SPIFFE identities, or PROXY‑protocol settings and effectively bypass namespace restrictions. This is an access control weakness classified as CWE‑863.

The vulnerability affects Traefik software distributed under the open‑source Traefik project. Impacted releases include 3.6.0‑3.6.22 and 3.7.0‑3.7.6, while the fix is available in 3.6.23 and 3.7.7.

The CVSS score of 5.3 indicates a medium severity, the EPSS score of less than 1 % suggests a low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. An attacker only needs to create or modify an IngressRouteTCP object that references a serversTransport entry such as foo@file; because the crossProviderNamespaces restriction is not applied, Traefik will resolve the reference and activate the configured file‑provider TCPServersTransport, potentially granting the attacker privileged access to the backend service or enabling traffic interception. The exploitation requires elevation within the Kubernetes cluster to influence IngressRouteTCP objects, but no additional network privileges are needed once the user can modify the object.