Описание
Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service resources in one namespace can set router.middlewares or service.serverstransport annotations to obtain another tenant's injected credentials or reuse its client certificates, bypassing namespace-based tenant isolation.
A flaw was found in Traefik. An authenticated attacker with permissions to create or update Kubernetes Ingress or Service resources can bypass multi-tenant isolation boundaries due to missing namespace validation in resource annotations. By referencing configuration objects in other namespaces, the attacker can access sensitive credentials and reuse client certificates belonging to other tenants.
Отчет
This vulnerability is rated as an Important severity because an authenticated tenant can breach isolation boundaries to access secrets or TLS certificates belonging to other namespaces. In environments where Traefik serves as the ingress controller, users permitted to define ingress specifications can supply unvalidated annotations that reference external middleware or transport configurations. Standard Red Hat OpenShift environments utilize the native OpenShift Ingress Operator rather than Traefik and are not exposed in default configurations.
Ссылки на источники
Дополнительная информация
Статус:
EPSS
7.1 High
CVSS3
Связанные уязвимости
Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service resources in one namespace can set router.middlewares or service.serverstransport annotations to obtain another tenant's injected credentials or reuse its client certificates, bypassing namespace-based tenant isolation.
Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace va ...
Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service resources in one namespace can set router.middlewares or service.serverstransport annotations to obtain another tenant's injected credentials or reuse its client certificates, bypassing namespace-based tenant isolation.
ALT-PU-2026-8219: package `traefik` update to version 3.6.17-alt1
EPSS
7.1 High
CVSS3