CVE-2026-85594 — Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware
Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes I…
Published: 2026-09-04 · CVSS: 7.0 · CVSS 4.0
Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its Service, and if that middleware injects backend credentials, recover them at a controlled backend.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7