CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Traefik Proxy

product · product:traefik-proxy

Coverage
1
first 2026-08-05 → last 2026-08-05
Latest activity
2026-08-05
Traefik patches three tenant-isolation failures; the worst hijacks another namespace's routes invisibly
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector, finance, telco · regions: europe
Sources cited
4
2 hosts

Action items (1)

Do-now tasks recorded on the entries about Traefik Proxy, newest first. Check the date before acting on an older one.

Defender insights

What each entry about Traefik Proxy tells a defender to do, newest first.

2026-08-05NOTABLETraefik patches three tenant-isolation failures; the worst hijacks another namespace's routes invisibly

Triage

Story timeline

  1. 2026-08-05Traefik 3.7.10 / 3.6.25 / 2.11.54, a route identity built by joining names with hyphens lets one Kubernetes namespace silently take over another's traffic on a shared Gateway
    trending-vulnerabilitiesTraefik patches three tenant-isolation failures; the worst hijacks another namespace's routes invisibly

Hunting pivots

Releases covered
Traefik Proxy
Tags
auth-bypassclouddefault-configpatch-availablevulnerabilities
ATT&CK techniques (2 across 6 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessValid Accounts
  • PersistenceValid Accounts
  • Privilege EscalationValid Accounts
  • StealthValid Accounts
  • Credential AccessAdversary-in-the-Middle
  • CollectionAdversary-in-the-Middle

Initial Access TA0001

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-05/traefik-kubernetes-multi-tenancy-route-identity-collision · ATT&CK page ↗

Persistence TA0003

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-05/traefik-kubernetes-multi-tenancy-route-identity-collision · ATT&CK page ↗

Privilege Escalation TA0004

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-05/traefik-kubernetes-multi-tenancy-route-identity-collision · ATT&CK page ↗

Stealth TA0005

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-05/traefik-kubernetes-multi-tenancy-route-identity-collision · ATT&CK page ↗

Credential Access TA0006

T1557Adversary-in-the-Middle×1

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.

Evidence: 2026-08-05/traefik-kubernetes-multi-tenancy-route-identity-collision · ATT&CK page ↗

Collection TA0009

T1557Adversary-in-the-Middle×1

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.

Evidence: 2026-08-05/traefik-kubernetes-multi-tenancy-route-identity-collision · ATT&CK page ↗

Entries about Traefik Proxy (1)

2026-08-05 · view entry permalink →

NOTABLENATOA2

Traefik 3.7.10 / 3.6.25 / 2.11.54, a route identity built by joining names with hyphens lets one Kubernetes namespace silently take over another's traffic on a shared Gateway

Traefik Labs published three security advisories on 2026-08-03, fixed in v3.7.10, v3.6.25 and v2.11.54, and CERT-FR relayed them the following day as CERTFR-2026-AVI-0964 (CERT-FR, 2026-08-04). None has a CVE identifier yet. All three break tenant isolation rather than confidentiality of the proxy itself, which makes them relevant to a specific and common deployment: the shared Kubernetes ingress, where several agencies or departments run namespaces behind one cluster gateway and the platform's security model rests on the assumption that a tenant cannot influence another tenant's routing.

The most serious flaw is a name-collision, not a missing check. In the Kubernetes Gateway API provider, Traefik constructs router and service identities by joining the route namespace, route name, Gateway identity, entry point and rule index with hyphens. Because Kubernetes object names may themselves contain hyphens, that construction is not injective; different inputs can produce the same string. Traefik Labs states the consequence directly: two distinct Routes attached to the same Gateway with equivalent match rules can produce the same identity, and the Route loaded later silently overwrites the earlier one (Traefik Labs, 2026-08-03). A tenant who controls the naming of their own Route objects can therefore take over traffic destined for another namespace. The word doing the work is silently: the victim tenant's own manifests are unchanged, so nothing in their view of the cluster indicates that their traffic is no longer arriving. It is rated CVSS 4.0 base 7.6 and affects v3.0.0–v3.6.24 and v3.7.0–v3.7.9.

The second flaw undermines the control an operator would reach for to prevent exactly this. In the Kubernetes CRD provider, the guard that rejects cross-namespace references was never applied to TraefikService backend references: for names containing an @ separator, Traefik applies only the crossProviderNamespaces allowlist check, and that check returns true by default because a nil allowlist means unrestricted (Traefik Labs, 2026-08-03). An operator who set allowCrossNamespace: false and considered the boundary enforced did not have it enforced for backend references. It is rated CVSS 4.0 base 4.8 and affects v2 up to 2.11.53 and v3 up to 3.6.24 and 3.7.9. The third, rated CVSS 4.0 base 2.1, is a BasicAuth deduplication-key collision: Traefik Labs describes the key as the delimiter-free concatenation of password and secret, so certain crafted inputs inherit another pair's verification result (Traefik Labs, 2026-08-03); where a header field is configured to pass the authenticated identity to the backend, that lets a low-privilege user present a different identity.

Detection concepts, telemetry class first. Both Kubernetes flaws manifest in the control plane rather than in traffic, so the audit log is the surface: create and update events for HTTPRoute, GRPCRoute, TCPRoute, TLSRoute and TraefikService objects, correlated against Traefik's own configuration-reload records. The specific artefacts are a Route object whose name introduces an extra hyphen-delimited segment, and a router referencing a service with a cross-namespace suffix. On the data plane, the corroborating signal is a change in backend destination for an established host and path with no matching change in the owning namespace's manifests.

Triage: GitOps controllers create and mutate Route objects continuously and legitimately, so object churn is the baseline rather than the signal. The discriminators are whether the acting identity is the platform's reconciler service account or a tenant's own, and whether the resulting router crosses a namespace boundary at all.

Two distinct Routes attached to the same Gateway with equivalent match rules can therefore produce the same identity, and the Route loaded later silently overwrites the earlier one

Traefik Labs (GHSA-fgjj-px3w-67xx)

For names that contain an @ separator (that is, @kubernetescrd cross-namespace references) it applies only the crossProviderNamespaces allowlist check, and that check returns true by default because a nil allowlist means "unrestricted".

Traefik Labs (GHSA-62fc-8686-hfmq)
vulnerability05 Aug 04:12Zmulti-sourceOpen finding →
Sources: Traefik Labs · CERT-FR / ANSSI

explore in graph

Where this entity is cited

  • Vulns1

Source distribution

  • github.com3 (75%)
  • cert.ssi.gouv.fr1 (25%)
All cited sources (4)