CVE-2026-112778
published 2026-10-19CVE-2026-112778: Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing…
PriorityP341medium6.4CVSS 4.0
AVNACLATNPRLUINVCNVINVANSCLSIHSAHEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.19%
8.0th percentile
Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service resources in one namespace can set router.middlewares or service.serverstransport annotations to obtain another tenant's injected credentials or reuse its client certificates, bypassing namespace-based tenant isolation.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| traefik | traefik | < 2.11.46 | 2.11.46 |
| traefik | traefik | >= 3.0.0 < 3.6.17 | 3.6.17 |
| traefik | traefik | >= 3.7.0 < 3.7.1 | 3.7.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Traefik up to 2.11.45/3.6.16 Kubernetes Provider access control
vuldb·2026-10-19·CVSS 6.4
CVE-2026-112778 [MEDIUM] Traefik up to 2.11.45/3.6.16 Kubernetes Provider access control
A vulnerability labeled as critical has been found in Traefik up to 2.11.45/3.6.16. The affected element is an unknown function of the component Kubernetes Provider. Such manipulation leads to improper access controls.
This vulnerability is documented as CVE-2026-112778. The attack can be executed remotely. There is not any exploit available.
The affected component should be upgraded.
GHSA
Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransp
ghsa_unreviewed·2026-10-19
CVE-2026-112778 [MEDIUM] CWE-862 Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransp
Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service resources in one namespace can set router.middlewares or service.serverstransport annotations to obtain another tenant's injected credentials or reuse its client certificates, bypassing namespace-based tenant isolation.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-19
Published