CVE-2026-85594

    Dashboard / Vulnerabilities / CVE-2026-85594

    CVE-2026-85594

    Published: 4 Sept 2026Last Modified: 18 Sept 2026

    Summary: Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware

    Details: Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its Service, and if that middleware injects backend credentials, recover them at a controlled backend.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85594.json, https://github.com/traefik/traefik/security/advisories/GHSA-m6wx-622r-48r9, https://nvd.nist.gov/vuln/detail/CVE-2026-85594, https://www.vulncheck.com/advisories/traefik-3.7.1-crossprovidernamespaces-bypass-via-service-middleware

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- fa49e2bcad7ffd8a80accdf1fae1ae480913d93d
    Fixed -faa1eb590646aed94e561e24a59be0c47353ae95

    Affected versions

    v3.7.10
    v3.7.9
    v3.7.8
    v3.7.7
    v3.7.6
    v3.7.5
    v3.7.4
    v3.7.3
    v3.7.2
    v3.7.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-85594 | CVE-DB