Go/github.com/traefik/traefik/v2 CVE-2026-65602: high 8.8, EPSS 0.33%

Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass in github.com/traefik/traefik

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-6192#Go/github.com/traefik/traefik/v2
• nvd: CVE-2026-65602
• https://github.com/traefik/traefik/security/advisories/GHSA-42cj-m3vj-89wv
• https://github.com/traefik/traefik/commit/67501cbe7bc7774e26ecbd1c29af97f098e14b0b
• https://github.com/traefik/traefik/pull/13458
• https://github.com/traefik/traefik/releases/tag/v3.6.23
• https://github.com/traefik/traefik/releases/tag/v3.7.7
• https://www.vulncheck.com/advisories/traefik-before-ingressroutetcp-serverstransport-namespace-bypass

CVE-2026-65602 · published 2026-08-18T14:32:29Z · modified 2026-08-18T15:00:17.659864518Z · JSON