CVE-2026-65601: 
NixOS vulnerability analysis and mitigation

CVE-2026-65601 is a namespace confusion vulnerability ("Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion") in Traefik's Kubernetes Gateway API provider, affecting versions 3.7.0 through 3.7.6. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik incorrectly uses the backend Service namespace instead of the HTTPRoute namespace, allowing a low-privileged route author to bind a Traefik Middleware from a foreign namespace without the required ReferenceGrant. The vulnerability was first published on July 9, 2026 (advisory) and disclosed publicly on July 22, 2026, with a fix released in version 3.7.7. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 5.3 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is an incorrect authorization check (CWE-863) combined with use of a less-trusted source (CWE-348): in pkg/provider/kubernetes/gateway/httproute.go, Traefik copies backendRef.Namespace into a local namespace variable to validate and load the cross-namespace backend Service, but then reuses that same variable when calling loadMiddlewares() for backendRef.filters[].extensionRef (line ~269). This means the ReferenceGrant check only validates access to the backend Service object (e.g., platform/protected-api), not to any Middleware in that namespace. The CRD provider then constructs a fully-qualified middleware reference such as platform-privileged-auth-header@kubernetescrd from the attacker-controlled namespace, and Traefik's service builder applies it at runtime to the backend load balancer handler. Exploitation requires the attacker to hold low-privileged HTTPRoute authoring capability in a Kubernetes cluster running the Gateway API provider; no unauthenticated remote exploitation is possible without first creating the malicious route (Github Advisory).

A successful exploit allows a low-privileged tenant route author to attach a Traefik Middleware from a privileged namespace (e.g., platform) to their HTTPRoute without authorization, causing Traefik to inject arbitrary trusted reverse-proxy identity headers (e.g., X-WEBAUTH-USER: admin) into downstream requests. Applications configured for reverse-proxy header authentication — including Grafana, Gitea, Jenkins, SonarQube, and Nexus Repository — may interpret these injected headers as authenticated identity, leading to unauthorized access and privilege escalation within those downstream systems. The vulnerability does not directly impact the Traefik host itself (no RCE, sandbox escape, or private-key exfiltration), but the subsequent system confidentiality and integrity impact is rated High (Github Advisory).

A public proof-of-concept (PoC) is included in the official security advisory, consisting of a shell script (run.sh), a Go test file, and a YAML fixture that reproduce the namespace confusion without requiring a live Kubernetes cluster. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.238% (15th percentile), indicating low near-term exploitation probability. Exploitation is not automatable because it requires the attacker to first obtain HTTPRoute authoring privileges in the target cluster (Github Advisory).

1. Obtain route-author access: Acquire low-privileged Kubernetes credentials with permission to create HTTPRoute objects in a tenant namespace (e.g., tenant-a) attached to a shared Gateway that uses Traefik as the Gateway API controller.
2. Identify a cross-namespace ReferenceGrant: Confirm that a ReferenceGrant exists in the target privileged namespace (e.g., platform) granting tenant-a HTTPRoutes permission to reference a specific backend Service (e.g., platform/protected-api).
3. Identify a target Middleware: Enumerate Traefik CRD Middleware objects in the backend namespace (e.g., platform/privileged-auth-header) that set trusted reverse-proxy identity headers such as X-WEBAUTH-USER.
4. Craft a malicious HTTPRoute: Create an HTTPRoute in tenant-a with a backendRef pointing to the cross-namespace Service (platform/protected-api) and add a backendRef.filters[].extensionRef referencing the target Middleware by name (privileged-auth-header) without specifying a namespace — Traefik will resolve it against the backend namespace (platform).
5. Apply the HTTPRoute: Submit the HTTPRoute manifest to the Kubernetes API server (kubectl apply -f malicious-httproute.yaml).
6. Trigger the middleware: Send HTTP requests to the hostname defined in the HTTPRoute (e.g., attacker.example) through the shared Gateway; Traefik will apply platform-privileged-auth-header@kubernetescrd, injecting X-WEBAUTH-USER: admin into all forwarded requests.
7. Achieve privilege escalation: Downstream applications configured for reverse-proxy header authentication will treat the injected header as a trusted authenticated identity, granting the attacker admin-level access (Github Advisory).

• Kubernetes API Audit Logs: Creation or modification of HTTPRoute objects in tenant namespaces that include backendRefs[].filters[].extensionRef entries referencing Middleware names in a different (privileged) namespace.
• Traefik Dynamic Configuration: Presence of middleware references in the form <backend-namespace>-<middleware-name>@kubernetescrd attached to services whose owning HTTPRoute resides in a different namespace — detectable via the Traefik dashboard or API (/api/http/services).
• Network/Application Logs: Downstream application logs (Grafana, Gitea, Jenkins, SonarQube, Nexus) showing authenticated sessions or admin-level actions initiated by requests that did not go through a legitimate authentication flow, particularly with X-WEBAUTH-USER or similar headers present.
• HTTPRoute Manifests: HTTPRoute resources where spec.rules[].backendRefs[].namespace differs from the HTTPRoute's own namespace AND spec.rules[].backendRefs[].filters[].extensionRef is populated — audit with kubectl get httproutes -A -o yaml | grep -A5 extensionRef.
• Traefik Access Logs: Requests to hostnames defined in suspicious cross-namespace HTTPRoutes that result in unexpected authenticated responses from backend services (Github Advisory).

Upgrade Traefik to version 3.7.7 or later, which fixes the issue by resolving extensionRef against the HTTPRoute namespace rather than the backend Service namespace (Github Advisory). For environments unable to patch immediately, the following workarounds reduce risk:

• Restrict which namespaces can attach HTTPRoute objects to shared Gateways, avoiding granting untrusted namespaces access to sensitive backends.
• Do not place privileged or identity-bearing Traefik Middleware objects in namespaces reachable by untrusted cross-namespace HTTPRoute backend references.
• Audit all HTTPRoute.rules[].backendRefs[].filters[].extensionRef entries for unauthorized cross-namespace Middleware bindings.
• Configure downstream applications to strip trusted reverse-proxy identity headers at the application boundary unless they originate from a dedicated, controlled authentication gateway.

The vulnerability was reported by security researcher CuB3y0nd and published by Traefik maintainer rtribotte via the official GitHub Security Advisory on July 9, 2026. Red Hat tracked the issue as high severity in Bugzilla (Bug 2506094), reflecting concern about privilege escalation in Kubernetes environments. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database aggregation (Github Advisory, Red Hat Bugzilla).