CVE-2026-85594

UNKNOWN 0.0

Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its Service, and if that middleware injects backend credentials, recover them at a controlled backend.

CWE	CWE-639
Vendor	traefik
Product	traefik
Published	Sep 4, 2026

Stay Ahead of the Next One

Get instant alerts for traefik traefik

Be the first to know when new unknown vulnerabilities affecting traefik traefik are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

traefik / traefik

3.7.1 ≤ 3.7.12

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/traefik/traefik/security/advisories/GHSA-m6wx-622r-48r9 vulncheck.com: https://www.vulncheck.com/advisories/traefik-3.7.1-crossprovidernamespaces-bypass-via-service-middleware

Credits

🔍 velgusgus599