Vulnerability · Published Sep 4, 2026 · Assigned by VulnCheck

CVE-2026-85594Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware

High 7.0

In plain English

A high-severity authorization bypass via user-controlled key in traefik from traefik. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 4.0)7.0High

Exploit odds (30 days)0.5%top 58.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its Service, and if that middleware injects backend credentials, recover them at a controlled backend.

Affected products (as reported)

Vendor	Product	Versions
traefik	traefik	3.7.1 – through 3.7.12

Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

References

GitHub Security Advisory (GHSA-m6wx-622r-48r9) vendor-advisory
VulnCheck Advisory: Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware third-party-advisory