The vulnerability is a configuration validation failure that allows a tenant limited by RBAC to a single namespace to bind its own router to a TraefikService in another namespace. This bypasses the allowCrossNamespace=false enforcement and can expose or redirect that namespace’s backend, effectively breaking namespace isolation. The weakness is a privilege boundary violation (CWE‑863) and resource conflict prevention (CWE‑653).

All users of Traefik Traefik software are potentially affected. Versions prior to 2.11.54, 3.6.25, and 3.7.10 are vulnerable; the fix is available in the corresponding releases. The attack can be carried out against deployments using the @kubernetescrd TraefikService type.

The CVSS score of 4.8 indicates moderate severity. The exploitability is high when a tenant has RBAC confinement to a namespace while cross‑namespace references are still permitted via TraefikService; the attacker would need only to create a router that references another namespace’s service. EPSS is not available, and the issue is not in CISA KEV catalogue. Still, the ability to expose or reroute an unintended backend could impact confidentiality, integrity or availability of services in the target namespace.