CVE-2026-112778: Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations
Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service resources in one namespace can set router.middlewares or service.serverstransport annotations to obtain another tenant's injected credentials or reuse its client certificates, bypassing namespace-based tenant isolation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Traefikto a version that resolves this vulnerability.Fixed in 2.11.46 - Upgrade
Upgrade
Traefikto a version that resolves this vulnerability.Fixed in 3.6.17 - Upgrade
Upgrade
Traefikto a version that resolves this vulnerability.Fixed in 3.7.1
Event History
Frequently Asked Questions
Who can exploit this issue in a Kubernetes cluster?
An attacker must be able to create or update Ingress or Service resources in a namespace. The issue is relevant where namespace-based tenant isolation is relied upon.
What cross-namespace resources can be referenced?
Affected annotations can reference Middlewares, ServersTransports, and TLSOptions from other namespaces. The router.middlewares and service.serverstransport annotations are specifically identified.
What is the remediation?
Upgrade Traefik to 2.11.46, 3.6.17, or 3.7.1 or later, as applicable. Versions before 2.11.46, 3.x before 3.6.17, and 3.7.0 are affected.