Search: CVE-2026-41174

CVE-2026-41174 is an authorization vulnerability in Traefik's Kubernetes CRD provider prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2. When cross-namespace middleware references are disallowed, Traefik correctly blocks direct references but fails to enforce this restriction for middleware nested inside a Chain middleware. This allows an actor with permission to create or update Traefik CRDs in their own namespace to bypass namespace isolation and apply middleware from other namespaces. The issue is patched in the specified fixed versions.