EUVD-2026-71017
GHSA-h3pc-28cx-rr37
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires specific multi-tenant deployment with credential-injecting middleware (AC:H) and low-privilege namespace write access (PR:L); stolen credentials impact systems beyond Traefik, warranting S:C and C:H with no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its Service, and if that middleware injects backend credentials, recover them at a controlled backend.
Articles & Coverage 1
AnalysisAI
Traefik's Kubernetes Ingress provider, starting from v3.7.1, incorrectly fails to enforce crossProviderNamespaces namespace-isolation controls on the traefik.ingress.kubernetes.io/service.middlewares Service annotation. A low-privileged tenant scoped to their own Kubernetes namespace can attach an operator-owned middleware from a namespace they are not permitted to reference, and if that middleware injects authentication credentials into backend requests, the attacker can exfiltrate those credentials via a backend endpoint under their control. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following concurrent conditions to be met: (1) Traefik v3.7.1 or later is deployed as the Kubernetes Ingress controller with crossProviderNamespaces configured to restrict cross-namespace middleware references for at least one tenant namespace; (2) the attacker holds a Kubernetes identity with write access to Service resources within their assigned namespace - a standard tenant role, not cluster-admin; (3) an operator-managed middleware exists in a namespace outside the tenant's allowlist that injects authentication credentials - such as an Authorization header, API key, or BasicAuth header - into backend requests toward protected systems; and (4) the attacker can deploy or observe a backend endpoint that receives and records HTTP request headers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.0 reflects a moderate-to-high real-world priority in affected multi-tenant environments, anchored by AT:P (specific attack preconditions must hold), which prevents broad automated exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Traefik security advisory at https://github.com/traefik/traefik/security/advisories/GHSA-m6wx-622r-48r9 for the patched release version - no specific fixed version number is confirmed in the currently available intelligence, and the advisory should be monitored for the corrected release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all clusters running Traefik 3.7.1 or later and determine which deployments rely on namespace isolation for security boundaries. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Vendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today