CVE-2026-85594

Executive Summary

CVE-2026-85594 is an authorization bypass in the Traefik Kubernetes Ingress provider affecting versions from v3.7.1, in which crossProviderNamespaces restrictions are not enforced on the traefik.ingress.kubernetes.io/service.middlewares Service annotation. A namespace-limited tenant that is not on the operator's allowlist can reference an operator-owned middleware and, if that middleware injects backend credentials, recover those credentials via a backend it controls. With a CVSS base score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), any organization running an affected Traefik multi-tenant Kubernetes Ingress deployment with cross-namespace middlewares enabled is at critical risk of credential disclosure and downstream lateral movement.

Technical Analysis

The vulnerability class is authorization bypass through user-controlled key / improper access control (CWE-639). Traefik's crossProviderNamespaces mechanism is designed to restrict which namespaces a given provider tenant is permitted to reference resources from across the Traefik provider boundary. Per the NVD description, versions from v3.7.1 fail to enforce that restriction specifically on the traefik.ingress.kubernetes.io/service.middlewares Service annotation inside the Kubernetes Ingress provider.

In a correctly functioning configuration, a namespace-limited tenant should only be able to attach middlewares that fall within its allowed set. Because enforcement is missing on this particular annotation path, a tenant excluded from the operator's allowlist can still reference — and thereby attach — a middleware owned by the operator. Middleware are arbitrary request/response processing components; the description notes that where a middleware "injects backend credentials," the tenant can then cause those credentials to be emitted to a backend under the tenant's control, effectively exfiltrating operator secrets.

The attack surface is the Kubernetes Ingress provider's annotation-processing path: any actor with the ability to create or modify Ingress resources (and in this case the Service annotation carrying the middleware reference) within a namespace-limited scope can exercise the flaw remotely (AV:N) with no privileges (PR:N) and no user interaction (UI:N). Note that exploitation impact is conditional: it depends on (a) a multi-tenant, namespace-isolated Traefik deployment where crossProviderNamespaces is configured, and (b) the presence of an operator-owned middleware that injects backend credentials. The NVD description does not enumerate specific middleware names, credential schemas, or code identifiers, so those specifics are not asserted here.

Exploitation Scenarios

No public PoC tooling, Nuclei template, or exploit code is available per the provided data; the exploit status is "Public" only as a status flag. The attack chain below is therefore described at the vulnerability-class level and maps strictly to the mechanism stated in the NVD description.

1. Reconnaissance / target identification. An attacker with tenant access to a namespace managed by an affected Traefik (>= v3.7.1) Kubernetes Ingress provider identifies that crossProviderNamespaces isolation is configured. The attacker enumerates operator-owned middlewares that are reachable in the cluster and identifies one that injects backend credentials.

2. Trigger of the specific flaw. The attacker authors or modifies an Ingress-managed resource carrying the traefik.ingress.kubernetes.io/service.middlewares Service annotation, pointing it at the operator-owned middleware. Because the restriction that should enforce crossProviderNamespaces is not applied to this annotation, the reference is accepted despite the tenant being excluded from the allowlist.

3. Payload / execution at the vulnerability-class level. Traefik attaches the operator-owned middleware to the tenant's Service. When traffic flows through that middleware, the credential-injecting behavior executes and the injected backend credentials are delivered to a backend the attacker controls.

4. Post-exploitation impact. The attacker recovers operator backend credentials, enabling authenticated access to backend services, lateral movement across trust boundaries, and potential data integrity/availability impact — consistent with the C/I/A:High subscores. There is no evidence of CISA KEV listing or confirmed in-the-wild exploitation in the supplied data.

Impact Assessment

Confidentiality: High. The core impact is credential disclosure — operator backend credentials can be recovered by a non-allowlisted tenant.

Integrity: High. Recovered backend credentials enable the attacker to act with the operator's authority against backend services, permitting unauthorized modification.

Availability: High. As with any credential-compromise pivot, the attacker can disrupt the targeted backends.

Scope: Unchanged (S:U). The vulnerable component and the impacted backends are treated within the same security authority bounding context.

Attack vector: Network (AV:N) / Low complexity (AC:L) / No privileges (PR:N) / No user interaction (UI:N). Blast radius is every multi-tenant Traefik Kubernetes Ingress deployment at or above v3.7.1 that (1) relies on crossProviderNamespaces for tenant isolation and (2) uses credential-injecting middlewares. Single-tenant or non-Kubernetes deployments are far lower risk.

Detection Guidance

Detection should focus on anomaly-based monitoring of Traefik/Kubernetes control-plane activity, since the vulnerable annotation is a configuration object rather than a network protocol. Because no public exploit signature exists, the rules below target the behavior class: cross-namespace middleware annotation changes and credential-bearing traffic to unapproved backends.

Sigma Rule

title: Traefik crossProviderNamespaces Bypass via service.middlewares Annotation
id: 7c4f1c2e-9b2a-4f8e-a3d1-2026cve85594
status: experimental
description: Detects creation/modification of Kubernetes Ingress/Service objects setting the traefik.ingress.kubernetes.io/service.middlewares annotation that may bypass crossProviderNamespaces restrictions (CVE-2026-85594).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85594
author: valtersit.com
date: 2026/01/01
logsource:
  product: kubernetes
  service: audit
detection:
  selection_annotation:
    verb:
      - create
      - update
      - patch
    objectRef.resource:
      - ingresses
      - services
  selection_mw:
    requestObject.metadata.annotations:
      - '*traefik.ingress.kubernetes.io/service.middlewares*'
  condition: selection_annotation and selection_mw
fields:
  - user.username
  - objectRef.namespace
  - requestObject.metadata.annotations
falsepositives:
  - Legitimate operator-driven middleware attachment in allowlisted namespaces
level: high

YARA Rule

rule CVE_2026_85594_Traefik_MiddlewareAnnotation
{
    meta:
        description = "Detects references to the Traefik service.middlewares annotation potentially abused in CVE-2026-85594"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85594"
        date = "2026-01-01"

    strings:
        $ann = "traefik.ingress.kubernetes.io/service.middlewares" ascii wide
        $cpn1 = "crossProviderNamespaces" ascii wide
        $cpn2 = "crossprovider" ascii nocase wide

    condition:
        $ann and ($cpn1 or $cpn2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85594 Traefik crossProviderNamespaces bypass attempt - service.middlewares annotation"; flow:established,to_server; http.header; content:"traefik.ingress.kubernetes.io/service.middlewares"; http.header; nocase; classtype:attempted-admin; sid:202685594; rev:1; metadata:reference nvd,cve CVE-2026-85594;)

Note: because the vulnerability is Kubernetes control-plane authorization logic, network detection is best-effort; the annotation string appearing in API server request bodies can be inspected where the API server is behind an IDS upstream.

Elastic Detection

sequence by user.username with maxspan=5m
  [any where event.action in ("create","update","patch") and kubernetes.resource in ("ingresses","services")]
  [any where kubernetes.annotations like~ "*traefik.ingress.kubernetes.io/service.middlewares*"]

An EQL single-event alternative:

any where
  event.category == "configuration" and
  kubernetes.annotations : "traefik.ingress.kubernetes.io/service.middlewares" and
  event.action in ("create","update","patch")

Splunk SPL Query

index=kubernetes_audit (verb=create OR verb=update OR verb=patch) (objectRef.resource=ingresses OR objectRef.resource=services)
| search requestObject.metadata.annotations=*"traefik.ingress.kubernetes.io/service.middlewares"*
| stats count min(_time) as first_seen max(_time) as last_seen values(objectRef.namespace) as namespaces by user.username, requestObject.metadata.name
| where count > 0
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")

Wazuh OSSEC Rule

<group name="kubernetes,traefik,cve-2026-85594,">
  <rule id="100594" level="12">
    <decoded_as>json</decoded_as>
    <field name="verb">\.+</field>
    <match>traefik.ingress.kubernetes.io/service.middlewares</match>
    <description>CVE-2026-85594: Kubernetes Ingress/Service configured with Traefik service.middlewares annotation - possible crossProviderNamespaces bypass</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED (single source: NVD; not independently confirmed). No vendor advisory version or workaround is supplied in the source data.

1) Immediate mitigations (before verified patch):

• If multi-tenant isolation is not required, avoid reliance on crossProviderNamespaces for security boundaries and restrict who can create/modify Ingress and Service objects and their annotations via Kubernetes RBAC.
• Audit all existing traefik.ingress.kubernetes.io/service.middlewares annotations and confirm none reference operator-owned, credential-injecting middlewares from non-allowlisted namespaces.
• Remove or disable credential-injecting middlewares that are cross-namespace reachable from untrusted tenants where operationally feasible.
• Apply Kubernetes admission policy (e.g., OPA/Gatekeeper or Kyverno) to deny cross-namespace middleware annotation references from non-allowlisted namespaces.

2) Patch / upgrade steps:

• Track the Traefik release notes and upgrade past v3.7.1 to the first release that restores crossProviderNamespaces enforcement on the service.middlewares annotation. Because the patch is only CLAIMED, verify the fix by testing the bypass in a non-production cluster before relying on it.
• Re-validate isolation post-upgrade by attempting to attach an allowlist-excluded middleware from a tenant namespace.

3) Long-term hardening:

• Treat Kubernetes namespace boundaries as security boundaries with least-privilege RBAC; never grant tenants write access to operator-owned resources.
• Minimize credential-injecting middlewares; prefer short-lived, per-tenant credentials and secret rotation.
• Enable Kubernetes audit logging and alerting as described in Detection Guidance.
• Rotate any operator backend credentials that may have been exposed.

References

• NVD — https://nvd.nist.gov/vuln/detail/CVE-2026-85594
• Traefik project (vendor) — https://github.com/traefik/traefik (consult releases/security advisories for the fixed version)
• CWE-639: Authorization Bypass Through User-Controlled Key — https://cwe.mitre.org/data/definitions/639.html
• CISA KEV Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-85594 not listed at time of writing)
• MITRE ATT&CK T1190 — Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/

Threat actor / exploitation evidence: No confirmed in-the-wild exploitation, no CISA KEV listing, and no public exploit code or Nuclei template were observed in the supplied intelligence data. EPSS is 0.00215 (12.1st percentile). Monitor upstream sources for emerging exploitation.