CVE-2026-112778

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 2.11.46 Traefik versions prior to 3.6.17 Traefik version 3.7.0

Description The Kubernetes Ingress provider lacks namespace validation for Ingress and Service annotations. This allows references to Middlewares, ServersTransports, and TLSOptions located in different namespaces. An attacker with permissions to create or update Ingress or Service resources in one namespace can manipulate the router.middlewares or service.serverstransport annotations to bypass namespace-based tenant isolation, potentially obtaining another tenant's injected credentials or reusing their client certificates.

Recommendations Update to version 2.11.46 or later. Update to version 3.6.17 or later. Update to a version newer than 3.7.0.