GPU VulnDB

Database/Container, Kubernetes & orchestration

Traefik: Service middleware annotation escapes crossProviderNamespaces restrictions

CVSS 7.0CVE-2026-85594Container, Kubernetes & orchestrationcurated

Impact

crossProviderNamespaces is the control that stops a tenant namespace from referencing operator-owned middleware. From v3.7.1 the service.middlewares annotation on a Service is not checked against that allowlist, so a namespace-limited tenant excluded from it can still attach a middleware it was never granted. Where that middleware injects backend credentials, such as an auth header or a shared upstream API key, the tenant attaches it to a Service pointing at a backend it controls and reads the credential straight out of the incoming request. On a GPU cluster where one Traefik fronts several tenants' inference endpoints, that turns the ingress layer into a cross-tenant credential leak, and the CVSS vector reflects it with a subsequent-system confidentiality impact.

Who can reach it

Any tenant able to create or edit a Service in a namespace Traefik watches, plus a backend of its own to receive the request. Authenticated Kubernetes access with ordinary namespace-scoped RBAC is enough; no cluster-admin and no node access.

What to do

Upgrade Traefik following GHSA-m6wx-622r-48r9. The record names v3.7.1 as where the behaviour starts but does not state a fixed version, so read the advisory before pinning a tag. Rollout is an image bump and restart of the Traefik controller pods, not a node drain. If you cannot upgrade immediately, block tenants from setting that annotation with an admission policy, and keep credential-injecting middleware out of reach of tenant-writable Services.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-85594https://github.com/traefik/traefik/security/advisories/GHSA-m6wx-622r-48r9https://www.vulncheck.com/advisories/traefik-3.7.1-crossprovidernamespaces-bypass-via-service-middleware

Related entries

All Container, Kubernetes & orchestration entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.