CVE-2026-65601: 
Traefik vulnerability analysis and mitigation

CVE-2026-65601 is a namespace confusion vulnerability in Traefik's Kubernetes Gateway API provider, classified as an authorization bypass (CWE-863, CWE-348). It affects Traefik versions 3.7.0 through 3.7.6 and was published on July 22, 2026. A low-privileged route author holding a ReferenceGrant for a cross-namespace Service can bind a Traefik Middleware from the backend namespace without a separate grant, potentially injecting trusted reverse-proxy identity headers into downstream requests. The issue is fixed in version 3.7.7. It carries a CVSS v3.1 base score of 9.6 (Critical) and a CVSS v4.0 base score of 5.3 (Medium) (Traefik Advisory, Github Advisory).

The root cause lies in how Traefik resolves HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef (CWE-863 Incorrect Authorization, CWE-348 Use of Less Trusted Source). In pkg/provider/kubernetes/gateway/httproute.go, when a cross-namespace backend Service is referenced, Traefik overwrites the namespace variable with the backend Service's namespace (e.g., platform) and then reuses that same variable when resolving backendRef.filters[].extensionRef — instead of using the originating HTTPRoute's namespace. The ReferenceGrant check only validates permission to reference the backend Service object, not any Middleware objects in that namespace. As a result, a tenant route in tenant-a can bind a Middleware named privileged-auth-header from the platform namespace (resolved as platform-privileged-auth-header@kubernetescrd), even though the ReferenceGrant only authorized access to platform/protected-api Service. A public PoC demonstrating the exploit via a Go unit test is included in the advisory (Traefik Advisory).

Successful exploitation allows a low-privileged route author to attach an unauthorized Traefik Middleware from a privileged namespace to their HTTPRoute, causing Traefik to inject trusted reverse-proxy identity headers (e.g., X-WEBAUTH-USER: admin) into downstream requests. This can lead to privilege escalation and authentication bypass in downstream applications that trust reverse-proxy headers, including Grafana, Gitea, Jenkins, SonarQube, and Nexus Repository when configured for reverse-proxy authentication. The impact is primarily on confidentiality and integrity of subsequent systems (rated High for both), with no direct availability impact. The vulnerability does not enable direct RCE, sandbox escape, or private-key exfiltration on the Traefik host itself (Traefik Advisory, Red Hat Bugzilla).

1. Prerequisite — Obtain route-author access: Gain low-privileged access to a Kubernetes namespace (e.g., tenant-a) that is permitted to create HTTPRoute objects attached to a shared Gateway.
2. Identify a cross-namespace ReferenceGrant: Locate or wait for a ReferenceGrant in a privileged namespace (e.g., platform) that allows tenant-a HTTPRoutes to reference a backend Service (e.g., platform/protected-api).
3. Identify a target Middleware: Enumerate Traefik Middleware objects in the backend namespace (platform) that set trusted identity headers (e.g., a Headers middleware injecting X-WEBAUTH-USER: admin).
4. Craft a malicious HTTPRoute: Create an HTTPRoute in tenant-a with a backendRef pointing to platform/protected-api and a backendRef.filters[].extensionRef referencing the target Middleware by name (e.g., privileged-auth-header) without specifying a namespace — Traefik will resolve it against the backend namespace platform.
5. Trigger Traefik configuration reload: Traefik's Kubernetes Gateway API provider will process the new HTTPRoute, incorrectly resolve the ExtensionRef as platform/privileged-auth-header, and attach the middleware to the generated backend service configuration.
6. Send requests through the malicious route: Send HTTP requests to the shared Gateway matching the attacker-controlled hostname (e.g., attacker.example). Traefik will apply the unauthorized middleware, injecting X-WEBAUTH-USER: admin into requests forwarded to the backend, potentially granting admin-level access in downstream applications that trust this header (Traefik Advisory).

• Kubernetes API Audit Logs: Creation of HTTPRoute objects in tenant namespaces with backendRefs[].filters[].extensionRef referencing Middleware names from a different (privileged) namespace; cross-namespace backendRef.namespace fields pointing to sensitive namespaces.
• Traefik Logs: Dynamic configuration entries showing middleware references in the format <backend-namespace>-<middleware-name>@kubernetescrd attached to services whose HTTPRoute originates from a different namespace; unexpected middleware bindings in Traefik's debug/access logs.
• Network: HTTP requests to backend services containing injected headers such as X-WEBAUTH-USER, X-Remote-User, or similar trusted identity headers that were not set by the legitimate authentication gateway.
• Application Logs: Downstream applications (Grafana, Gitea, Jenkins, SonarQube, Nexus) logging authenticated sessions or privileged actions attributed to users (e.g., admin) that do not correspond to legitimate user activity, particularly when reverse-proxy authentication is enabled (Traefik Advisory).

Upgrade Traefik to version 3.7.7 or later, which fixes the issue by resolving extensionRef against the HTTPRoute namespace instead of the backend Service namespace (Traefik Advisory). For environments that cannot immediately upgrade, the following workarounds are recommended:

• Restrict HTTPRoute creation and management to trusted administrators only; do not grant untrusted tenants permission to attach HTTPRoutes to shared Gateways that route to sensitive backends.
• Avoid placing privileged or identity-bearing Traefik Middleware objects in namespaces accessible via cross-namespace HTTPRoute backend references.
• Prefer route-local filters and explicitly audit all HTTPRoute.rules[].backendRefs[].filters[].extensionRef usages in your cluster.
• Strip trusted reverse-proxy identity headers at backend application boundaries unless they originate from a dedicated, controlled authentication gateway (Traefik Advisory, Red Hat Bugzilla).

The vulnerability was reported by security researcher CuB3y0nd and published by Traefik maintainer rtribotte on July 9, 2026 via the official GitHub Security Advisory. Red Hat tracked the issue as high severity in their Bugzilla system (Bug 2506094), noting it as a privilege escalation via Kubernetes Gateway API namespace confusion. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database aggregation (Traefik Advisory, Red Hat Bugzilla).