CVE-2026-54765: 
NixOS vulnerability analysis and mitigation

CVE-2026-54765 is an authorization bypass vulnerability in Traefik's Kubernetes Gateway API provider, classified as "Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port." It affects Traefik versions v3.7.0 through v3.7.5 and was discovered on 2026-06-04, with the advisory published on 2026-07-01 and CVE assigned on 2026-07-06. The vulnerability was fixed in v3.7.6, released 2026-06-30. It carries a CVSS v3.1 base score of 8.5 (High) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, Traefik Release).

The root cause (CWE-284: Improper Access Control, CWE-863: Incorrect Authorization) lies in pkg/provider/kubernetes/gateway/httproute.go within the loadService() and loadMiddlewares() functions. The dynamic backend service key was constructed from only the backend namespace, Service name, protocol, and port — omitting the HTTPRoute, listener, rule, or backendRef filter identity. When two accepted HTTPRoutes target the same backend Service:port with different backendRef filters, both route WRR services resolve to the same child service key (e.g., default-whoami-http-80), and a subsequent maps.Copy operation overwrites one route's filter configuration with the other's. The fix in PR #13367 prefixes generated service names with a per-backend key derived from the router/route key plus backend index, ensuring uniqueness (GitHub Advisory, Fix PR, Fix Commit).

An attacker with low-privileged access to create an accepted HTTPRoute in a Kubernetes cluster can cause their route's backendRef filter context — including security-sensitive headers such as tenant identity, authorization context, role assignments, or Host/path rewrites trusted by the backend — to be applied to another route's requests. This effectively bypasses authorization controls and can cross namespace boundaries when a ReferenceGrant permits cross-namespace targeting, enabling unauthorized access to resources in other tenants' namespaces. The integrity impact is rated High (CVSS v3.1), as the backend receives requests with incorrect security context, while confidentiality impact is rated Low due to potential exposure of cross-tenant data (GitHub Advisory).

1. Reconnaissance: Identify a target Kubernetes cluster running Traefik v3.7.0–v3.7.5 as the Gateway API provider, with a Gateway listener configured with allowedRoutes.namespaces.from: All or a ReferenceGrant permitting cross-namespace backend targeting.
2. Identify target route: Locate an existing accepted HTTPRoute (e.g., route-a in namespace default) that targets a backend Service:port (e.g., default/whoami:80) and uses a backendRef filter to set a security-sensitive header (e.g., X-Tenant: tenant-a).
3. Create attacker HTTPRoute: In an attacker-controlled namespace (e.g., attacker), create an accepted HTTPRoute (route-b) that targets the same backend Service:port (default/whoami:80 via ReferenceGrant) with a different backendRef filter (e.g., X-Tenant: tenant-b).
4. Trigger filter collision: Traefik resolves both routes to the same child service key (e.g., default-whoami-http-80). The maps.Copy operation causes one route's filter configuration to overwrite the other's.
5. Achieve authorization bypass: Requests from route-a (tenant-a) are now processed with route-b's filter context (tenant-b), or vice versa. The backend receives requests with the wrong tenant/authorization header, granting the attacker access to resources belonging to the victim tenant (GitHub Advisory).

• Kubernetes API Audit Logs: Unexpected HTTPRoute creation events in namespaces not typically associated with backend services, especially routes targeting Service:port combinations already used by other routes in different namespaces.
• Traefik Configuration: Presence of multiple HTTPRoutes resolving to the same child service key (pre-patch naming format: <namespace>-<service>-http-<port>) in Traefik's dynamic configuration or /api/rawdata endpoint.
• Application Logs: Backend services receiving requests with unexpected or mismatched tenant identity, authorization, or context headers (e.g., X-Tenant, X-Auth-Context) that do not correspond to the originating route's expected values.
• ReferenceGrant Objects: Existence of ReferenceGrant resources permitting cross-namespace HTTPRoute-to-Service targeting that were not explicitly authorized by cluster administrators.

The primary remediation is to upgrade Traefik to version v3.7.6 or later, which fixes the collision by prefixing generated service names with a per-backend key derived from the route key and backend index (Traefik Release). Note that this change alters the exported_service metrics label format, which may break existing alerting rules with filters based on the old naming pattern — review and update monitoring configurations accordingly (Fix PR). As a workaround prior to patching, restrict Kubernetes RBAC permissions to limit which users or service accounts can create or modify HTTPRoutes, and audit existing ReferenceGrant objects to remove unnecessary cross-namespace backend targeting permissions (GitHub Advisory).

The vulnerability was credited to Qican Ma and Ding Luo of XiaoMi ShadowBlade Security Lab, who provided a detailed Go test harness demonstrating the filter collision (GitHub Advisory). A community user noted that the fix's change to service naming conventions broke existing Prometheus alerting rules that relied on the old exported_service label format, prompting the Traefik team to commit to documenting the change in the migration guide (Fix PR).