CVE-2026-112778
Full vulnerability record from the local CVENow database.
Description
Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service resources in one namespace can set router.middlewares or service.serverstransport annotations to obtain another tenant's injected credentials or reuse its client certificates, bypassing namespace-based tenant isolation.
Severity
MEDIUM
CVSS score
6.4
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-10-19 20:17:55.187000
Last modified
2026-10-23 17:04:01.690000
View original CVE JSON
{
"id": "CVE-2026-112778",
"sourceIdentifier": "[email protected]",
"published": "2026-10-19T20:17:55.187",
"lastModified": "2026-10-23T17:04:01.690",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service resources in one namespace can set router.middlewares or service.serverstransport annotations to obtain another tenant's injected credentials or reuse its client certificates, bypassing namespace-based tenant isolation."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "traefik",
"product": "traefik",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/traefik/traefik/v2",
"versions": [
{
"version": "0",
"lessThan": "2.11.46",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.11.46",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "traefik",
"product": "traefik",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/traefik/traefik/v3",
"versions": [
{
"version": "3.0.0",
"lessThan": "3.6.17",
"versionType": "semver",
"status": "affected"
},
{
"version": "3.6.17",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "traefik",
"product": "traefik",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/traefik/traefik/v3",
"versions": [
{
"version": "3.7.0",
"lessThan": "3.7.1",
"versionType": "semver",
"status": "affected"
},
{
"version": "3.7.1",
"versionType": "semver",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-19T21:15:57.381151Z",
"id": "CVE-2026-112778",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-862"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.11.46",
"matchCriteriaId": "2FBDBA4B-9AFC-4B78-9847-01614C64A2D7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.0.0",
"versionEndExcluding": "3.6.16",
"matchCriteriaId": "C4BFCFD4-29AA-4ECD-A7FA-B4897266CB84"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:traefik:traefik:3.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D886A0C9-A478-4A38-98A6-4D96121D1304"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/traefik/traefik/security/advisories/GHSA-rh7m-2m44-x32f",
"source": "[email protected]",
"tags": [
"Vendor Advisory",
"Patch"
]
},
{
"url": "https://www.vulncheck.com/advisories/traefik-before-2.11.46-3.6.17-and-3.7.1-cross-namespace-resource-reference-via-kubernetes-annotations",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
}
]
}