Is CVE-2026-119573 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119573 being exploited in the wild.

How severe is CVE-2026-119573?

Medium severity, with a CVSS score of 4.4, published 30 October 2026.

Which products and versions are affected?

Traefik Labs Traefik 3.7.11 through 3.7.14.

Is there a fix for CVE-2026-119573?

Yes: fixed in 3.7.15. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-119573 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-119573?

Check whether you run Traefik Labs Traefik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119573: Traefik authorization bypass in Kubernetes Ingress NGINX provider

CVE-2026-119573 · Severity: medium · CVSS 4.4 · Published 2026-10-30

Traefik is a reverse proxy and ingress controller used to route traffic to applications in Kubernetes clusters. A flaw in versions 3.7.11 through 3.7.14 allows users with permission to create Ingresses in one namespace to bypass namespace isolation and reuse TLS certificates from other namespaces, discovering whether secrets exist in other namespaces. While the contents of the secrets are not exposed, this undermines the namespace isolation security model.

Technologies: Traefik Labs Traefik. Vendors: Traefik Labs.

Quick answers

Is CVE-2026-119573 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119573 being exploited in the wild.
How severe is CVE-2026-119573?: Medium severity, with a CVSS score of 4.4, published 30 October 2026.
Which products and versions are affected?: Traefik Labs Traefik 3.7.11 through 3.7.14.
Is there a fix for CVE-2026-119573?: Yes: fixed in 3.7.15. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119573 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-119573?: Check whether you run Traefik Labs Traefik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.7.15

Technical details

The vulnerability is an authorization bypass (CWE-863) in the Kubernetes Ingress NGINX provider's cross-namespace validation for the auth-tls-secret annotation. When a client authentication TLS option is cached and reused across Ingresses, the cross-namespace authorization check—which normally runs only on first use—is skipped. An attacker with Ingress creation privileges can reference a CA secret from another namespace that was previously cached, bypassing namespace isolation and learning of the secret's existence without accessing its contents.

Affected products

Traefik Labs Traefik 3.7.11 through 3.7.14

Timeline

2026-10-16: disclosed
2026-10-30: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.