--- id: "GHSA-rh7m-2m44-x32f" page: "https://infrastack.ai/live/GHSA-rh7m-2m44-x32f" kind: "vulnerability" aliases: ["GHSA-rh7m-2m44-x32f"] title: "Traefik: Kubernetes Ingress and Service annotations allow cross-namespace references to Middlewares, ServersTransports, and TLSOptions" severity: "medium" cvss: 6.4 epss: null exploited: false status: "open" category: "infrastructure" products: [{"name": "github.com/traefik/traefik/v2", "fixed": ["v2.11.46"], "affected": "<= v2.11.45", "ecosystem": "go"}, {"name": "github.com/traefik/traefik/v3", "fixed": ["v3.6.17"], "affected": ">= v3.0.0, <= v3.6.16", "ecosystem": "go"}, {"name": "github.com/traefik/traefik/v3", "fixed": ["v3.7.1"], "affected": ">= v3.7.0, <= v3.7.0", "ecosystem": "go"}] ecosystems: ["go"] tags: ["cwe-862", "go", "infrastructure", "kubernetes", "multi-tenant", "traefik"] not_affected_if: ["crd-provider-only", "managed-hosting", "single-tenant-cluster"] published_at: "2026-10-05T12:05:46+00:00" first_seen_at: "2026-11-09T22:53:33+00:00" updated_at: "2026-11-09T23:00:52+00:00" sources: [{"source": "ghsa-repo", "url": "https://github.com/traefik/traefik/security/advisories/GHSA-rh7m-2m44-x32f", "first_seen_at": "2026-11-09T22:53:33+00:00"}] exploit_sources: [] --- # Traefik: Kubernetes Ingress and Service annotations allow cross-namespace references to Middlewares, ServersTransports, and TLSOptions Link for people: https://infrastack.ai/live/GHSA-rh7m-2m44-x32f (this .md is for agents) Traefik's Kubernetes Ingress and Service annotations accept references to Middlewares, ServersTransports and TLSOptions in other namespaces without the namespace check that the CRD provider applies. A user who can create Ingress or Service resources in one namespace can reuse another tenant's middleware, such as one injecting an API token, or a client certificate configured in a ServersTransport. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - go:github.com/traefik/traefik/v2 affected <= v2.11.45 fixed v2.11.46 - go:github.com/traefik/traefik/v3 affected >= v3.0.0, <= v3.6.16 fixed v3.6.17 - go:github.com/traefik/traefik/v3 affected >= v3.7.0, <= v3.7.0 fixed v3.7.1 ## How to check - Run `traefik version` or check the image tag to find the Traefik version, and compare it with the fixed versions. - Check whether the `kubernetesIngress` provider is in use and whether untrusted users can create or update Ingress or Service resources in any namespace. - Look for `router.middlewares`, `service.serverstransport` or TLS option annotations on Ingress and Service objects that point to another namespace. ## Fix - Traefik v2: move to `2.11.46` - Traefik v3: move to `3.6.17` - Traefik v3.7.0: move to `3.7.1` - The advisory adds a `crossProviderNamespaces` option on the Kubernetes providers to restrict which namespaces may use cross-provider references; when unset, all namespaces remain allowed. ## Timeline - 2026-11-09T22:53:33+00:00 ghsa-repo https://github.com/traefik/traefik/security/advisories/GHSA-rh7m-2m44-x32f ## Documents - [advisory] Vendor advisory: github.com https://github.com/traefik/traefik/security/advisories/GHSA-rh7m-2m44-x32f ## From the sources ## Summary There is a medium severity vulnerability in Traefik's Kubernetes Ingress provider that allows an actor with permission to create or update `Ingress` or `Service` resources in one namespace to reference `Middleware`, `ServersTransport`, and `TLSOption` resources from other namespaces through annotations. Unlike the Kubernetes CRD provider, which rejects such references when `allowCrossNamespace` is disabled, the annotation path performs no namespace validation, partially bypassing namespace-based tenant isolation. In multi-tenant clusters, this can expose another tenant's secrets, such as credentials injected by a `Headers` middleware or a client certificate configured in a `ServersTransport`. The fix introduces the `crossProviderNamespaces` option on the Kubernetes providers, which must be explicitly set to restrict which namespaces are allowed to use cross-provider references; when it is left unset, all namespaces remain allowed. ## Patches - https://github.com/traefik/traefik/releases/tag/v2.11.46 - https://github.com/traefik/traefik/releases/tag/v3.6.17 - https://github.com/traefik/traefik/releases/tag/v3.7.1 ## For more information If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).
Original Description # Traefik: Missing Cross-Namespace Validation When Using K8s Annotations ## Brief Summary Traefik in Kubernetes (K8s) allows cross-namespace access to Traefik resources when using Annotations on Ingress and Service resources. ## Table of Content - [Traefik: Missing Cross-Namespace Validation When Using K8s Annotations](#traefik-missing-cross-namespace-validation-when-using-k8s-annotations) - [Brief Summary](#brief-summary) - [Table of Content](#table-of-content) - [Description](#description) - [Affected Version](#affected-version) - [Source Code References](#source-code-references) - [Prerequisites](#prerequisites) - [Impact](#impact) - [Security Researcher / Reporter](#security-researcher--reporter) - [Proof of Concept](#proof-of-concept) - [Middleware Proof Of Concept](#middleware-proof-of-concept) - [Step 1: Preparation](#step-1-preparation) - [Step 2: Create Victim's Resources](#step-2-create-victims-resources) - [Step 3: Create Attacker Resources](#step-3-create-attacker-resources) - [Step 4: Attacker steals API Token](#step-4-attacker-steals-api-token) - [ServersTransport Proof Of Concept](#serverstransport-proof-of-concept) - [Step 1: Create Victim and Attacker Namespaces](#step-1-create-victim-and-attacker-namespaces) - [Step 2: Create Victim Resources](#step-2-create-victim-resources) - [Step 3: Create Attacker Resources](#step-3-create-attacker-resources-1) - [Step 3: Attacker steals Client Certificate to authenticate against protected resource living in the victim's own namespace](#step-3-attacker-steals-client-certificate-to-authenticate-against-protected-resource-living-in-the-victims-own-namespace) - [Recommendation](#recommendation) - [Appendix](#appendix) - [Resources](#resources) - [PoC router.middlewares / victim.yaml](#poc-routermiddlewares--victimyaml) - [PoC router.middlewares / attacker.yaml](#poc-routermiddlewares--attackeryaml) - [PoC service.serverstransport / victim.yaml](#poc-serviceserverstransport--victimyaml) - [PoC service.serverstransport / attacker.yaml](#poc-serviceserverstransport--attackeryaml) - [PoC router.middlewares intern-demo-access-victims-pod-wo-auth.txt](#poc-routermiddlewares-intern-demo-access-victims-pod-wo-authtxt) - [PoC router.middlewares intern-demo-access-victims-pod-with-auth.txt](#poc-routermiddlewares-intern-demo-access-victims-pod-with-authtxt) - [Test Setup](#test-setup) ## Description When using the Ingress and Service Annotations, it is possible to reference Middlewares, ServersTransports, and TLSOptions from foreign namespaces. While this is disallowed by default for Traefik's Kubernetes CRDs (by the [Configuration Option ``providers.kubernetesCRD.allowCrossNamespace``](https://doc.traefik.io/traefik/reference/install-configuration/providers/kubernetes/kubernetes-crd/#opt-providers-kubernetesCRD-allowCrossNamespace)), no validation is done when using Annotations on K8s Ingress and Service resources. An attacker can include these resources in an Ingress or Service configuration and thereby partially bypassing namespace-based tenant isolation. In certain cases, this will give an attacker access to data of services in other namespaces, for instance: - If a middleware adds an API access token through the Header middleware, an attacker can steal this token. - An attacker could include a ServersTransport that does client certificate authentication against a service to access this service. - An attacker could include a ForwardAuth middleware to gain access to the internal response headers of the forward auth service and thus might steal internal tokens. ## Affected Version The vulnerability was tested in the current Traefik version v3.6.5. Older versions are affected, too. ## Source Code References Ingress and Service Annotations are vulnerable. There is no check implemented in: [``pkg/provider/kubernetes/ingress/kubernetes.go``](https://github.com/traefik/traefik/blob/f794f8a29491b8467868811a3142a48e8f0a3854/pkg/provider/kubernetes/ingress/kubernetes.go#L202) Traefik's Kubernetes CRDs are not vulnerable and prevent cross namespace access: [``pkg/provider/kubernetes/crd/kubernetes_http.go``](https://github.com/traefik/traefik/blob/f794f8a29491b8467868811a3142a48e8f0a3854/pkg/provider/kubernetes/crd/kubernetes_http.go#L170) ## Prerequisites - Traefik is installed in Kubernetes - No special configuration is required as the ``kubernetesIngress`` provider is enabled by default - The attacker needs permission to create or modify Ingress or Service resources in one namespace - The name of the namespace and the name of the Middleware, TLSOption, or ServersTransport resource they want to target ## Impact An attacker can include Middlewares, ServersTransports, and TLSOptions resources from foreign namespaces in their own Ingress or Service configuration, thereby partially bypassing namespace-based tenant isolation. In certain cases, this will give an attacker access to data of services in other namespaces. ## Security Researcher / Reporter - Lorin Lehawany of ERNW Enno Rey Netzwerke GmbH - Sven Nobis of ERNW Enno Rey Netzwerke GmbH ## Proof of Concept The following descriptions explain the exploitation in detail for the two affected resource types Middleware and ServersTransport. The proof of concept (PoC) was tested in a Traefik setup installed via Helm chart in version `37.4.0`, but with the most recent Traefik app version ``v3.6.5`` and the default configuration. See the [test setup section](#test-setup) for details. ### Middleware Proof Of Concept The following steps demonstrate the problem with the affected ``router.middlewares`` annotation. This PoC even works with restrictive Network Policies set. #### Step 1: Preparation First, the namespaces `traefik-victim` and `traefik-attacker` are created: ```sh kubectl create namespace traefik-victim kubectl create namespace traefik-attacker namespace/traefik-victim created namespace/traefik-attacker created ``` In the next steps, the resources in the `victim.yaml` are created in the namespace `traefik-victim`, and the resources in the `attacker.yaml` are created in the namespace `traefik-attacker`. #### Step 2: Create Victim's Resources This step creates some resources to simulate a typical vulnerable setup with an application that uses Traefik and Ingress. The [`victim.yaml`](#poc-routermiddlewares--victimyaml) creates an Ingress resource with the name `traefik-ingress` in the namespace `traefik-victim`. The Ingress exposes the victim's application under the hostname `traefik --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_