CVE-2026-85594: Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware
Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its Service, and if that middleware injects backend credentials, recover them at a controlled backend.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
traefikto a version that resolves this vulnerability.Fixed in v3.7.1 - Compensating control
Restrict/avoid use of the traefik.ingress.kubernetes.io/service.middlewares Ingress annotation from tenants/namespaces that are not in the allowlist, since Traefik v3.7.1 does not properly enforce crossProviderNamespaces restrictions for that annotation in the Kubernetes Ingress provider.
Event History
Frequently Asked Questions
Who would realistically be able to exploit this issue?
A namespace-limited tenant that is excluded from the crossProviderNamespaces allowlist can exploit it if they can attach the traefik.ingress.kubernetes.io/service.middlewares annotation to a Service and direct traffic to a backend they control.
What is the potential impact if an affected middleware handles credentials?
The tenant can attach an operator-owned middleware despite the intended restriction. If that middleware injects backend credentials, the tenant may recover those credentials at their controlled backend.
Which Traefik usage should be prioritized for review?
Prioritize Traefik deployments using the Kubernetes Ingress provider, particularly where Service resources use the traefik.ingress.kubernetes.io/service.middlewares annotation and crossProviderNamespaces is relied upon to isolate tenant namespaces.