Traefik 3.7.10 / 3.6.25 / 2.11.54 — a route identity built by joining names with hyphens lets one Kubernetes namespace silently take over another's traffic on a shared Gateway
Traefik Labs published three security advisories on 2026-08-03, fixed in v3.7.10, v3.6.25 and v2.11.54, and CERT-FR relayed them the following day as CERTFR-2026-AVI-0964 (CERT-FR, 2026-08-04). None has a CVE identifier yet. All three break tenant isolation rather than confidentiality of the proxy itself, which makes them relevant to a specific and common deployment: the shared Kubernetes ingress, where several agencies or departments run namespaces behind one cluster gateway and the platform's security model rests on the assumption that a tenant cannot influence another tenant's routing.
The most serious flaw is a name-collision, not a missing check. In the Kubernetes Gateway API provider, Traefik constructs router and service identities by joining the route namespace, route name, Gateway identity, entry point and rule index with hyphens. Because Kubernetes object names may themselves contain hyphens, that construction is not injective — different inputs can produce the same string. Traefik Labs states the consequence directly: two distinct Routes attached to the same Gateway with equivalent match rules can produce the same identity, and the Route loaded later silently overwrites the earlier one (Traefik Labs, 2026-08-03). A tenant who controls the naming of their own Route objects can therefore take over traffic destined for another namespace. The word doing the work is silently: the victim tenant's own manifests are unchanged, so nothing in their view of the cluster indicates that their traffic is no longer arriving. It is rated CVSS 4.0 base 7.6 and affects v3.0.0–v3.6.24 and v3.7.0–v3.7.9.
The second flaw undermines the control an operator would reach for to prevent exactly this. In the Kubernetes CRD provider, the guard that rejects cross-namespace references was never applied to TraefikService backend references: for names containing an @ separator, Traefik applies only the crossProviderNamespaces allowlist check, and that check returns true by default because a nil allowlist means unrestricted (Traefik Labs, 2026-08-03). An operator who set allowCrossNamespace: false and considered the boundary enforced did not have it enforced for backend references. It is rated CVSS 4.0 base 4.8 and affects v2 up to 2.11.53 and v3 up to 3.6.24 and 3.7.9. The third, rated CVSS 4.0 base 2.1, is a BasicAuth deduplication-key collision: Traefik Labs describes the key as the delimiter-free concatenation of password and secret, so certain crafted inputs inherit another pair's verification result (Traefik Labs, 2026-08-03); where a header field is configured to pass the authenticated identity to the backend, that lets a low-privilege user present a different identity.
Detection concepts, telemetry class first. Both Kubernetes flaws manifest in the control plane rather than in traffic, so the audit log is the surface: create and update events for HTTPRoute, GRPCRoute, TCPRoute, TLSRoute and TraefikService objects, correlated against Traefik's own configuration-reload records. The specific artefacts are a Route object whose name introduces an extra hyphen-delimited segment, and a router referencing a service with a cross-namespace suffix. On the data plane, the corroborating signal is a change in backend destination for an established host and path with no matching change in the owning namespace's manifests.
Triage: GitOps controllers create and mutate Route objects continuously and legitimately, so object churn is the baseline rather than the signal. The discriminators are whether the acting identity is the platform's reconciler service account or a tenant's own, and whether the resulting router crosses a namespace boundary at all.
Two distinct Routes attached to the same Gateway with equivalent match rules can therefore produce the same identity, and the Route loaded later silently overwrites the earlier one
For names that contain an @ separator (that is, @kubernetescrd cross-namespace references) it applies only the crossProviderNamespaces allowlist check, and that check returns true by default because a nil allowlist means "unrestricted".
Defender actions
- Upgrade Traefik to 3.7.10, 3.6.25 or 2.11.54 on any cluster where a Gateway or ingress is shared between namespaces that belong to different teams or agencies — the isolation the platform's tenancy model assumes is what is broken here.
ATT&CK mapping
2 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Persistence TA0003
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Privilege Escalation TA0004
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Stealth TA0005
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Credential Access TA0006
T1557Adversary-in-the-Middle
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.
Collection TA0009
T1557Adversary-in-the-Middle
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.