Traefik versions prior to 2.11.46, 3.x before 3.6.17, and 3.7.0 fail to enforce namespace validation for Ingress and Service annotations, allowing an attacker with the ability to create or update these resources to reference Middlewares, ServersTransports, and TLSOptions in other namespaces. This leads to the disclosure of other tenants’ injected credentials or the reuse of their client certificates, effectively breaking tenant isolation. The flaw is an Incorrect Authorization weakness (CWE‑862) and carries a CVSS score of 6.4.

The vulnerability exists in Traefik releases before 2.11.46, before 3.6.17 in the 3.x series, and in version 3.7.0. All deployments running those versions are affected; upgrades beyond the mentioned releases are required for remediation.

With a moderate CVSS score of 6.4 and no EPSS or KEV listing, the vulnerability is not widely exploited yet but poses significant risk in multi‑tenant Kubernetes environments where an attacker can write Ingress or Service resources. The likely attack vector is an internal or compromised account with permissions to modify Ingress or Service objects. Once exploited, the attacker can obtain cross‑namespace credentials, compromising confidentiality and integrity of other tenants’ services.