Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service… (CVE-2026-85594)

Traefik versions from 3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation within the Kubernetes Ingress provider. This flaw enables a namespace-limited tenant, excluded from the allowlist, to attach an operator-owned middleware to its Service. If the middleware injects backend credentials, the tenant can recover these credentials at a backend under their control. This vulnerability is tracked as CVE-2026-85594 and is associated with CWE-639 (Authorization Bypass Through User-Controlled Key).

An attacker with namespace-limited access can bypass cross-provider namespace restrictions to attach operator-owned middleware to their Service. This can lead to unauthorized recovery of backend credentials if the middleware injects such credentials, potentially compromising confidentiality, integrity, and availability of backend services. The CVSS score of 9.8 indicates a critical impact on confidentiality, integrity, and availability without requiring privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a fix is available, restrict access to namespaces and monitor for suspicious middleware attachments. Follow vendor advisories closely for updates on remediation.