Traefik Kubernetes Ingress provider lacks namespace validation for Ingress/Service annotations, allowing cross-namespace references to Middlewares, ServersTransports, and TLSOptions. An attacker with rights to create/update Ingress or Service can set router.middlewares or service.serverstransport to reuse another namespace’s injected credentials/client certs, bypassing tenant isolation. Affects traefik < 2.11.46, 3.0.0-3.6.16, 3.7.0. Upgrade to 2.11.46, 3.6.17, or 3.7.1 to mitigate.