CVE-2026-85594
published 2026-09-04CVE-2026-85594: Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation…
PriorityP353critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.48%
40.2th percentile
Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its Service, and if that middleware injects backend credentials, recover them at a controlled backend.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| traefik | traefik | < 3.7.11 | 3.7.11 |
| traefik | traefik | 3.7.1 – 3.7.12 | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.07.0HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
github.com/traefik/traefik: Traefik: Information disclosure via crossProviderNamespaces bypass in Kubernetes Ingress provider
vendor_redhat·2026-09-04·CVSS 7.0
CVE-2026-85594 [HIGH] CWE-1220 github.com/traefik/traefik: Traefik: Information disclosure via crossProviderNamespaces bypass in Kubernetes Ingress provider
github.com/traefik/traefik: Traefik: Information disclosure via crossProviderNamespaces bypass in Kubernetes Ingress provider
A flaw was found in Traefik. The software fails to enforce `crossProviderNamespaces` restrictions on the `traefik.ingress.kubernetes.io/service.middlewares` Service annotation within the Kubernetes Ingress provider. This vulnerability allows a namespace-limited tenant, even if excluded from the allowlist, to attach an operator-owned middleware to its Service. If this middleware injects backend credentials, the tenant can then recover these credentials at a controlled backend, leading to information disclosure.
Statement: A flaw was found in Traefik's Kubernetes Ingress provider (v3.7.1 through v3.7.10) where crossProviderNamespaces isolation is not enforced for th
GHSA
Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider.
ghsa_unreviewed·2026-09-04
CVE-2026-85594 [HIGH] CWE-639 Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider.
Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its Service, and if that middleware injects backend credentials, recover them at a controlled backend.
No detection rules found.
No public exploits indexed.
2026-09-04
Published