CVE-2026-85594: Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware
Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its Service, and if that middleware injects backend credentials, recover them at a controlled backend.
Affected Software
Event History
Frequently Asked Questions
Who would realistically be able to exploit this issue?
A namespace-limited tenant that is excluded from the crossProviderNamespaces allowlist can exploit it if they can attach the traefik.ingress.kubernetes.io/service.middlewares annotation to a Service and direct traffic to a backend they control.
What is the potential impact if an affected middleware handles credentials?
The tenant can attach an operator-owned middleware despite the intended restriction. If that middleware injects backend credentials, the tenant may recover those credentials at their controlled backend.
Which Traefik usage should be prioritized for review?
Prioritize Traefik deployments using the Kubernetes Ingress provider, particularly where Service resources use the traefik.ingress.kubernetes.io/service.middlewares annotation and crossProviderNamespaces is relied upon to isolate tenant namespaces.