CVE-2026-112778: 
NixOS vulnerability analysis and mitigation

CVE-2026-112778 is a missing authorization vulnerability in Traefik's Kubernetes Ingress provider that allows cross-namespace references to Middlewares, ServersTransports, and TLSOptions via Ingress and Service annotations. It affects Traefik versions before 2.11.46, 3.x before 3.6.17, and 3.7.0 (fixed in 3.7.1). The vulnerability was published on October 19, 2026, and was discovered by Lorin Lehawany and Sven Nobis of ERNW Enno Rey Netzwerke GmbH. It carries a CVSS v4.0 base score of 6.4 (Medium) (GitHub Advisory, Traefik Advisory).

The root cause is a missing authorization check (CWE-862) in Traefik's Kubernetes Ingress provider (pkg/provider/kubernetes/ingress/kubernetes.go), which performs no namespace validation when processing annotations on Ingress and Service resources. In contrast, the Kubernetes CRD provider correctly enforces namespace boundaries via the allowCrossNamespace configuration option. An attacker with low-privilege access (permission to create or update Ingress or Service resources in any namespace) can set the traefik.ingress.kubernetes.io/router.middlewares or traefik.ingress.kubernetes.io/service.serverstransport annotations to reference resources — such as a Headers middleware containing an API token or a ServersTransport with mTLS client certificates — from a victim's namespace. The fix introduces a crossProviderNamespaces option on Kubernetes providers to restrict which namespaces are permitted to use cross-provider references (Traefik Advisory).

Successful exploitation allows an attacker to bypass namespace-based tenant isolation in multi-tenant Kubernetes clusters, enabling them to steal credentials injected by another tenant's Headers middleware (e.g., API tokens) or reuse another tenant's mTLS client certificates to authenticate against protected internal services. The primary impact is on the integrity and availability of subsequent systems (rated High for both), with low confidentiality impact on subsequent systems. This can lead to unauthorized access to other tenants' internal services, credential theft, and potential lateral movement within the cluster, particularly in shared Kubernetes environments (Traefik Advisory, GitHub Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The EPSS score is 0.0, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low privileges (the ability to create or modify Ingress or Service resources in at least one namespace) and no user interaction, making it accessible to any tenant in a multi-tenant cluster (GitHub Advisory, VulnCheck).

1. Reconnaissance: Identify the target Traefik deployment version and confirm it is running a vulnerable version (< 2.11.46, 3.x < 3.6.17, or 3.7.0) using kubectl describe pod -n <traefik-namespace> or by inspecting Helm release metadata.
2. Identify target resources: Enumerate Middlewares, ServersTransports, or TLSOptions in victim namespaces using kubectl get middleware --all-namespaces or kubectl get serverstransport --all-namespaces (if RBAC permits listing), or infer resource names from Traefik logs or documentation.
3. Craft malicious Ingress (Middleware theft): In the attacker-controlled namespace, create an Ingress resource with the annotation traefik.ingress.kubernetes.io/router.middlewares: "<victim-namespace>-<middleware-name>@kubernetescrd" pointing to the victim's Headers middleware. Route traffic to an attacker-controlled backend (e.g., a whoami container that reflects all HTTP headers).
4. Steal injected credentials: Send HTTP requests to the attacker-controlled Ingress hostname. Traefik applies the victim's middleware, injecting the victim's secret headers (e.g., X-API-Token) into the request, which are then reflected by the attacker's backend and captured.
5. Craft malicious Service (mTLS certificate abuse): Alternatively, create a Service resource in the attacker's namespace with the annotation traefik.ingress.kubernetes.io/service.serverstransport: "<victim-namespace>-<serverstransport-name>@kubernetescrd" and route traffic via a proxy (e.g., socat) to the victim's mTLS-protected service.
6. Authenticate as victim: Traefik uses the victim's ServersTransport (including their client certificate) to perform mTLS authentication against the victim's internal service, granting the attacker unauthorized access (Traefik Advisory).

• Logs: Traefik pod logs showing middleware or ServersTransport resources from one namespace being applied to routers in a different namespace (e.g., middlewareName=<victim-namespace>-<middleware>@kubernetescrd in a router named after the attacker's namespace); log entries like Creating middleware ... middlewareName=<foreign-namespace>-<name>@kubernetescrd routerName=<attacker-namespace>-....
• Kubernetes Audit Logs: Unexpected creation or modification of Ingress or Service resources with cross-namespace annotation values (e.g., traefik.ingress.kubernetes.io/router.middlewares referencing a namespace other than the resource's own namespace).
• Network: Unusual traffic from Traefik to internal services in namespaces that should not be accessible from the originating Ingress namespace; unexpected mTLS handshakes using certificates belonging to a different tenant's namespace.
• Kubernetes Resources: Ingress or Service objects with annotations referencing resources in foreign namespaces — detectable via kubectl get ingress --all-namespaces -o json | jq '.items[] | select(.metadata.annotations | to_entries[] | .value | contains("@kubernetescrd")) | {namespace: .metadata.namespace, name: .metadata.name, annotations: .metadata.annotations}' (Traefik Advisory).

Upgrade Traefik to a patched version: 2.11.46, 3.6.17, or 3.7.1 or later. The fix introduces the crossProviderNamespaces option on Kubernetes providers, which should be explicitly configured to restrict cross-namespace references. As an interim workaround, restrict RBAC permissions to limit which users or service accounts can create or modify Ingress and Service resources, implement Kubernetes audit logging to detect suspicious cross-namespace annotation usage, and review existing Ingress and Service annotations for references to resources in foreign namespaces (Traefik Advisory, VulnCheck).

The vulnerability was discovered and responsibly disclosed by security researchers Lorin Lehawany and Sven Nobis of ERNW Enno Rey Netzwerke GmbH, who provided detailed proof-of-concept demonstrations for both the Middleware and ServersTransport attack scenarios. The Traefik maintainers published a security advisory (GHSA-rh7m-2m44-x32f) and released patched versions promptly. No significant broader media coverage or notable social media reactions have been observed beyond the initial advisory publication (Traefik Advisory).