Traefik v3.7.1 allows a tenant that has only namespace‑level privileges to attach an operator‑owned middleware to a Service via the traefik.ingress.kubernetes.io/service.middlewares annotation. When that middleware injects backend credentials, the compromised tenant can retrieve those credentials from a controlled backend. The vulnerability effectively bypasses the intended crossProviderNamespaces restriction, enabling unauthorized credential access. Based on the description, the likely attack vector involves modifying a Service annotation to reference operator‑owned middleware, which then injects secrets that the tenant can recover.

Affected systems are Traefik deployments using the Kubernetes Ingress provider. Only the version that contains the flaw is v3.7.1; later releases are presumed corrected. Customers running v3.7.1 or earlier that have not updated should verify their deployment version and upgrade accordingly.

The CVSS score of 7.0 classifies this flaw as moderate severity, but the absence of EPSS data and its absence from CISA’s KEV list suggest lower exploitation probability at present. However, the ability to manipulate Service annotations is a common configuration capability in Kubernetes, and the missing cross‑namespace check means attackers do not need elevated privileges beyond normal namespace permissions. In environments where operator‑owned middleware already exists, the risk is elevated, and the attacker can directly recover backend secrets. Therefore organizations should treat this as a significant risk, especially if internal RBAC is not constructed to limit Service annotation changes.