Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112778— Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations

Quick assessment

Affected
traefik traefik
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Kubernetes Ingress 提供程序中，Traefik 2.11.46 之前的版本、3.x 系列中 3.6.17 之前的版本以及 3.7.0 版本均缺少对 Ingress 和 Service 注解的命名空间验证。这导致攻击者可以在一个命名空间中创建或更新 Ingress 或 Service 资源，并通过设置 或 注解，引用其他命名空间中的 Middlewares、ServersTransports 和 TLSOptions 配置。利用该漏洞，攻击者能够获取其他租户注入的凭据，或复用其客户端证书，从而绕

CVSS 6.4 · Medium

Affected Version Matrix 6

VendorProduct Version RangeStatus
traefik traefik < 2.11.46 affected
2.11.46 unaffected
3.0.0< 3.6.17 affected
3.6.17 unaffected
3.7.0< 3.7.1 affected
3.7.1 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112778

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations
Source: CVE Program / CVE List V5
Vulnerability Description
Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service resources in one namespace can set router.middlewares or service.serverstransport annotations to obtain another tenant's injected credentials or reuse its client certificates, bypassing namespace-based tenant isolation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
traefik traefik 0 ~ 2.11.46 -
traefik traefik 3.0.0 ~ 3.6.17 -
traefik traefik 3.7.0 ~ 3.7.1 -

II. Public POCs for CVE-2026-112778

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112778

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-112778 (1)

Other References for CVE-2026-112778 (1)

IV. Related Vulnerabilities

Same product: traefik
Same vendor: traefik
Same weakness: CWE-862

V. Comments for CVE-2026-112778

No comments yet

Leave a comment