CVE-2026-112778

Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service resources in one namespace can set router.middlewares or service.serverstransport annotations to obtain another tenant's injected credentials or reuse its client certificates, bypassing namespace-based tenant isolation.

CVSS 4.0

6.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:H

CVSS 3.1

8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.2% chance of exploitation in the next 30 days; higher than 10% of CVEs (scores of 2026-10-25)

CWE

CWE-862

Published

2026-10-19

Modified

2026-10-23

Record from

the NVD, synced 2026-10-24

Affected

• traefik:traefik

References

• https://github.com/traefik/traefik/security/advisories/GHSA-rh7m-2m44-x32f
• https://www.vulncheck.com/advisories/traefik-before-2.11.46-3.6.17-and-3.7.1-cross-namespace-resource-reference-via-kubernetes-annotations

Check your stackJSON