CVE-2026-112778 Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations

Medium 6.4 Published 19 Oct 2026 Updated 19 Oct 2026

Attackers can bypass namespace isolation in Traefik Kubernetes providers to access other tenants' credentials and certificates via malicious annotations.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-112778?

CVE-2026-112778 is a medium-severity missing authorization vulnerability in Traefik Traefik, published on 19 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service resources in one namespace can set router.middlewares or service.serverstransport annotations to obtain another tenant's injected credentials or reuse its client certificates, bypassing namespace-based tenant isolation.

Weakness: CWE-862

Which versions are affected by CVE-2026-112778?

It affects 1 product.

Products include Traefik Traefik.

How do I fix CVE-2026-112778?

No fix has been published for CVE-2026-112778 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-112778 being exploited?

There is no known exploitation of CVE-2026-112778 in the wild and no public exploit code.

All Traefik Traefik vulnerabilities

Sources

Also known as GHSA-35mp-944w-x8rj, GHSA-rh7m-2m44-x32f.