CVE-2026-85594

Name of the Vulnerable Software and Affected Versions Traefik versions 3.7.1 and later

Description The Kubernetes Ingress provider fails to enforce crossProviderNamespaces restrictions regarding the traefik.ingress.kubernetes.io/service.middlewares Service annotation. This allows a namespace-limited tenant that is not on the allowlist to attach a middleware owned by an operator to its Service. If the middleware is configured to inject backend credentials, the tenant can recover those credentials at a backend they control.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.