CVE-2026-112778 in Traefik
Summary
by MITRE • 10/19/2026
Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service resources in one namespace can set router.middlewares or service.serverstransport annotations to obtain another tenant's injected credentials or reuse its client certificates, bypassing namespace-based tenant isolation.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in Traefik versions prior to 2.11.46 and 3.x prior to 3.6.17 represents a critical failure in the Kubernetes Ingress provider's handling of resource references within annotations. Specifically, the software lacks proper namespace validation when processing annotations for Middlewares, ServersTransports, and TLSOptions associated with Ingress or Service resources. This architectural flaw allows an attacker who has been granted permissions to create or update these resources within a specific namespace to reference configuration objects located in entirely different namespaces. By manipulating router.middlewares or service.serverstransport annotations, the malicious actor can effectively bypass the intended isolation boundaries that separate tenants or applications operating on the same Kubernetes cluster.
From a technical perspective, this issue stems from insufficient validation logic during the parsing of Traefik's dynamic configuration sources. When an Ingress resource is processed, Traefik resolves references to external middleware and transport configurations without verifying that these referenced resources reside within the same namespace as the ingress definition itself. This behavior contradicts standard Kubernetes security models where namespace boundaries are expected to enforce strict separation of state and access controls. Consequently, a user with write access to an Ingress resource in one namespace can point it toward sensitive configuration objects defined by another tenant or system component in a different namespace, effectively bridging the isolation gap that namespaces are designed to maintain.
The operational impact of this vulnerability is severe, as it directly compromises multi-tenant security and data confidentiality. An attacker exploiting this flaw can gain unauthorized access to credentials injected via middleware configurations or reuse client certificates defined in TLSOptions belonging to other tenants. This capability allows for credential theft, session hijacking, and potential man-in-the-middle attacks against services that rely on the compromised transport or TLS settings. The breach of namespace-based tenant isolation undermines trust in multi-tenant Kubernetes environments, where different teams or customers expect their configurations and data to remain strictly segregated from one another.
This vulnerability aligns with CWE-284 Improper Access Control, as it involves a failure to enforce proper restrictions on the access granted to users for specific resources. Furthermore, it relates to CWE-798 Use of Hard-coded Credentials if the referenced TLSOptions or Middlewares contain static secrets that are now exposed through improper reference resolution. In terms of offensive security frameworks, this exploitation technique corresponds to ATT&CK T1530 Data from Cloud Storage Object Misconfiguration and potentially T1606 Forge Web Credentials, as it involves leveraging misconfigured access controls to steal authentication material or impersonate other services within the cluster.
To mitigate this risk, organizations must immediately upgrade Traefik to version 2.11.46 or later for the v2 series, or version 3.6.17 and later for the v3 series, where these namespace validation checks have been implemented. In addition to upgrading, administrators should audit their Kubernetes RBAC policies to ensure that users with permissions to create or update Ingress resources do not possess excessive privileges over other configuration objects such as Middlewares, ServersTransports, or TLSOptions across all namespaces. Implementing strict network policies and monitoring for unusual cross-namespace resource references can also help detect potential exploitation attempts before significant damage occurs.