Namespace Validation Vulnerability in Traefik by Traefik Labs

CVE-2026-112778

What is CVE-2026-112778?

The vulnerability arises from Traefik's failure to validate namespaces for Ingress and Service annotations in its Kubernetes Ingress provider. This allows malicious actors, who can modify Ingress or Service resources in one namespace, to reference Middlewares, ServersTransports, and TLSOptions in different namespaces. By doing so, they may access another tenant's credentials or client certificates, thereby compromising tenant isolation and creating significant security risks.

References