https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T06:40:54.710748+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-365077 EUVD-2026-365077 2026-10-05T06:40:54.761582+00:00 EUVD-2026-365077 https://cve.radiocsirt.org/vuln/fkie_cve-2026-85594 fkie_cve-2026-85594 2026-10-05T06:40:54.761625+00:00

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its Service, and if that middleware injects backend credentials, recover them at a controlled backend.

 https://cve.radiocsirt.org/vuln/ghsa-h3pc-28cx-rr37 GHSA-h3pc-28cx-rr37 2026-10-05T06:40:54.761671+00:00

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its Service, and if that middleware injects backend credentials, recover them at a controlled backend.