Traefik EUVD-2026-104584

Requires Traefik deployed as the Kubernetes Ingress provider in a multi-tenant cluster that relies on namespace separation for isolation, AND the attacker holding Kubernetes RBAC permissions to create or update Ingress or Service resources in at least one namespace (consistent with PR:L). The vulnerability is in the lack of namespace validation when resolving router.middlewares and service.serverstransport annotations, so exploitation depends on victim tenants having referenceable Middleware, ServersTransport, or TLSOptions resources carrying credentials or client certificates. Limiting factors: the attack yields nothing in single-tenant deployments, requires pre-existing namespaced write access rather than anonymous network access, and is eliminated by upgrading to 2.11.46, 3.6.17, or 3.7.1.

This is a genuine but moderate-priority issue best understood as an authorization/tenant-isolation flaw (CWE-862 Missing Authorization), not a classic auth bypass. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows network reachability with low attack complexity, but PR:L is the critical constraint: the attacker must already hold valid, if low-privileged, access - specifically Kubernetes RBAC rights to create or update Ingress/Service objects in at least one namespace. The impact metrics are telling: the vulnerable Traefik system itself takes no direct impact (VC:N/VI:N/VA:N), while the harm lands entirely on subsequent systems - other tenants (SC:L/SI:H/SA:H), reflecting cross-tenant credential theft and certificate reuse. No EPSS score, KEV listing, or POC indicator was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The 6.4/Medium score is consistent with these signals: real and worth patching in multi-tenant clusters, but gated behind existing in-cluster write access rather than being remotely exploitable against a default single-tenant install. EPSS and real-world exploitation data are MISSING and should be verified; absence of a KEV entry should not be read as proof the flaw is unexploitable, only that CISA has not catalogued it.

A low-privileged tenant who can create or update Ingress/Service resources in their own Kubernetes namespace sets a router.middlewares or service.serverstransport annotation that references a Middleware, ServersTransport, or TLSOptions object belonging to a different tenant's namespace. Because Traefik performs no namespace validation on these references, the attacker's router inherits the victim tenant's injected credentials (e.g., basic-auth or forward-auth secrets) or reuses its client certificates, breaking namespace-based isolation. No public exploit code is identified at time of analysis, though the technique is straightforward to reproduce given the required namespace write access.