Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress… (CVE-2026-112778)

The vulnerability in Traefik's Kubernetes Ingress provider arises from the lack of namespace validation on annotations related to Middlewares, ServersTransports, and TLSOptions. This flaw permits attackers who can create or modify Ingress or Service resources within one namespace to reference resources in other namespaces, potentially exposing credentials or client certificates belonging to other tenants. This breaks the intended isolation between namespaces in multi-tenant Kubernetes environments. The affected versions are Traefik before 2.11.46, all 3.x versions before 3.6.17, and version 3.7.0. No patch links or vendor advisory details are provided in the input, and no known exploits in the wild have been reported.

An attacker with limited privileges to create or update Ingress or Service resources in a Kubernetes namespace can exploit this vulnerability to bypass namespace isolation. This can lead to unauthorized access to sensitive credentials or client certificates injected into other namespaces, potentially compromising tenant security in multi-tenant Kubernetes clusters.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor Traefik's official channels for updates addressing this namespace validation issue. Until a fix is available, restrict permissions to create or update Ingress and Service resources to trusted users only to reduce risk.