CVE-2026-85594 Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware

What is CVE-2026-85594?

CVE-2026-85594 is a high-severity missing authorization vulnerability in Traefik Traefik, published on 4 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its Service, and if that middleware injects backend credentials, recover them at a controlled backend.

Weakness: CWE-639

Which versions are affected by CVE-2026-85594?

It affects 1 product.

Products include Traefik Traefik.

How do I fix CVE-2026-85594?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-85594 being exploited?

There is no known exploitation of CVE-2026-85594 in the wild and no public exploit code.

Other vulnerabilities in Traefik Traefik

• CVE-2024-45410 HTTP client can remove the X-Forwarded headers in Traefik Critical 9.8
• CVE-2026-88877 Traefik v3.7.0 Authentication Bypass via from-to-www-redirect Critical 9.3
• CVE-2026-85595 Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth Critical 9.3
• CVE-2026-88007 Traefik HTTP/3 Backend NTLM Connection Reuse Critical 9.1
• CVE-2026-88009 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging High 8.8

All Traefik Traefik vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-h3pc-28cx-rr37, GHSA-m6wx-622r-48r9, MINI-gp88-4qvg-jxfg, MINI-j2qm-xr5x-x975, MINI-wxhm-2cj6-3gf5.