CVE-2026-85594: Traefik Auth Bypass Vulnerability

CVE-2026-85594 Overview

CVE-2026-85594 is a broken access control flaw in Traefik versions from v3.7.1 affecting the Kubernetes Ingress provider. The proxy fails to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its own Service. If that middleware injects backend credentials, the tenant can capture them by routing traffic to a controlled backend. The issue is classified under [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact
Tenants in restricted namespaces can steal backend credentials injected by operator-managed middlewares, breaking multi-tenant isolation in shared Kubernetes clusters.

Affected Products

Traefik Proxy versions from v3.7.1
Kubernetes Ingress provider configurations using crossProviderNamespaces
Multi-tenant clusters relying on middleware namespace isolation

Discovery Timeline

2026-09-04 - CVE-2026-85594 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85594

Vulnerability Analysis

Traefik's Kubernetes Ingress provider processes the traefik.ingress.kubernetes.io/service.middlewares annotation on Kubernetes Services. This annotation lets operators bind reusable middlewares (authentication, header injection, rate limiting) to backend Services. The crossProviderNamespaces setting is intended to restrict which namespaces may reference middlewares from other providers or namespaces.

Starting in v3.7.1, the Ingress provider stopped enforcing this restriction on the Service annotation path. Any tenant with write access to Services in their namespace can name an arbitrary operator-owned middleware, regardless of allowlist configuration. The tenant does not need cluster-wide permissions or access to the middleware's source namespace.

When the referenced middleware injects backend credentials — for example, adding an Authorization header or an API token for an upstream service — Traefik applies that middleware to requests targeting the tenant's Service. Because the tenant controls the backend, the credentials arrive at an attacker-controlled endpoint in cleartext.

Root Cause

The root cause is missing authorization enforcement at the Service annotation parsing layer. The Ingress provider validates middleware references for IngressRoute custom resources but omits the same check when middlewares are declared via the Service annotation. This inconsistency creates a bypass that circumvents the tenant boundary that crossProviderNamespaces was designed to enforce.

Attack Vector

Exploitation requires low-privileged access (PR:L) to create or modify a Kubernetes Service in a namespace excluded from the middleware allowlist. The attacker:

Deploys a Service pointing at a backend they control.
Adds the traefik.ingress.kubernetes.io/service.middlewares annotation referencing an operator-owned middleware known to inject credentials.
Triggers routing through Traefik and reads the injected credentials from the backend request logs.

The attack succeeds without user interaction and produces high confidentiality impact on the referenced backend systems. Refer to the GitHub Security Advisory GHSA-m6wx-622r-48r9 and the VulnCheck Advisory Traefik Bypass for the full technical write-up.

Detection Methods for CVE-2026-85594

Indicators of Compromise

Kubernetes Services in restricted namespaces carrying the traefik.ingress.kubernetes.io/service.middlewares annotation that references middlewares outside their permitted scope.
Services whose backend endpoints resolve to external IPs, cluster-egress hosts, or workloads owned by non-operator identities.
Traefik access logs showing traffic routed through operator middlewares to tenant-controlled destinations.

Detection Strategies

Audit all Service manifests across namespaces for the service.middlewares annotation and cross-reference each named middleware against the crossProviderNamespaces allowlist.
Correlate Kubernetes API audit events for services/create and services/patch operations that add middleware annotations from low-privileged service accounts.
Inspect Traefik configuration reload events for middleware bindings that violate expected tenant-to-middleware mappings.

Monitoring Recommendations

Enable Kubernetes audit logging at Metadata level or higher for services and forward events to a centralized analytics pipeline.
Alert on any Service annotation change that references a middleware in a namespace the tenant does not own.
Track outbound requests from Traefik pods to non-cluster destinations that contain authentication headers.

How to Mitigate CVE-2026-85594

Immediate Actions Required

Inventory Traefik deployments and identify any instances running v3.7.1 or later with the Kubernetes Ingress provider enabled.
Enumerate operator-owned middlewares that inject credentials, headers, or tokens and treat them as high-value assets pending patching.
Restrict RBAC so tenants cannot add or modify the traefik.ingress.kubernetes.io/service.middlewares annotation on Services in shared clusters.

Patch Information

Apply the fixed Traefik release identified in the GitHub Security Advisory GHSA-m6wx-622r-48r9. The upstream fix restores crossProviderNamespaces enforcement on the Service annotation path so cross-namespace middleware references are rejected when the source namespace is not in the allowlist.

Workarounds

Disable the Kubernetes Ingress provider and migrate to IngressRoute custom resources where middleware references are validated correctly.
Use a Kubernetes admission controller (OPA Gatekeeper, Kyverno) to reject Services carrying the traefik.ingress.kubernetes.io/service.middlewares annotation in tenant namespaces.
Remove credential-injecting middlewares from shared middleware namespaces and scope them to specific tenant namespaces via IngressRoute only.

bash

# Kyverno policy to block the vulnerable Service annotation in tenant namespaces
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: block-traefik-service-middlewares
spec:
  validationFailureAction: Enforce
  rules:
    - name: deny-service-middlewares-annotation
      match:
        any:
          - resources:
              kinds:
                - Service
              namespaces:
                - "tenant-*"
      validate:
        message: "Setting traefik.ingress.kubernetes.io/service.middlewares is not allowed in tenant namespaces (CVE-2026-85594)."
        pattern:
          metadata:
            =(annotations):
              X(traefik.ingress.kubernetes.io/service.middlewares): "null"