CVE-2026-85594
CVE-2026-85594 · Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its Service, and if that middleware injects backend credentials, recover them at a controlled backend.
CVSS 7.0 · High · EPSS 0.5%
- Published
- Updated
Stack: web
Affected products and versions
traefik
- Versions
- ≥ 3.7.1, ≤ 3.7.12: Affected (semver)
No fix published