CVE-2026-54761: Traefik authorization bypass in Kubernetes Gateway crossProviderNamespaces

CVE-2026-54761 · Severity: medium · CVSS 3.1 · Published 2026-06-23

Traefik is a popular open-source tool used to manage and route web traffic into applications. A security flaw in its Kubernetes integration allows users in restricted areas of a network to bypass safety rules and access internal administrative interfaces, such as the Traefik dashboard or API. This could allow an unauthorized user to view sensitive configuration details or internal system information that should be protected.

Technologies: github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go), Traefik Labs Traefik Proxy. Vendors: Go, Traefik Labs.

Quick answers

Is CVE-2026-54761 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54761 being exploited in the wild.
How severe is CVE-2026-54761?
Medium severity, with a CVSS score of 3.1, published 23 June 2026.
Which products and versions are affected?
github.com/traefik/traefik (Go) SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.7.34; github.com/traefik/traefik/v2 (Go) SEMVER:introduced=0, SEMVER:introduced=0,last_affected=2.11.50; github.com/traefik/traefik/v3 (Go) SEMVER:introduced=0,fixed=3.6.21, SEMVER:introduced=0,fixed=3.6.21,introduced=3.7.0-ea.1,fixed=3.7.5; Traefik Labs Traefik Proxy < 3.6.21, >= 3.7.0-ea.1, < 3.7.5.
Is there a fix for CVE-2026-54761?
Yes. github.com/traefik/traefik/v3 (Go): upgrade to 3.6.21, 3.7.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54761 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54761?
Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/traefik/traefik/v3 (Go): upgrade to 3.6.21, 3.7.5 or later
    go get github.com/traefik/traefik/v3@v3.7.5

Technical details

An authorization bypass exists in Traefik's Kubernetes Gateway provider due to incorrect validation of the 'crossProviderNamespaces' allowlist. When an HTTPRoute uses multiple backend references (Weighted Round Robin), Traefik checks the allowlist against the target 'backendRef.namespace' instead of the namespace where the route originated. An attacker with permissions to create an HTTPRoute in an untrusted namespace can reference internal TraefikServices (e.g., api@internal) by pointing the backend namespace to a trusted one, provided a Gateway API ReferenceGrant exists. This allows the exposure of internal Traefik services on the data plane. The issue is resolved in versions 3.6.21 and 3.7.5.

Affected products

  • Traefik Traefik < 3.6.21, >= 3.7.0-ea.1, < 3.7.5

Identifiers

  • CVE-2026-54761
  • GHSA-3g6v-2r68-prfc
  • GO-2026-5083

Timeline

  • 2026-06-10: patched: Fixes included in releases 3.6.21 and 3.7.5
  • 2026-06-11: advisory: GitHub Security Advisory GHSA-3g6v-2r68-prfc published
  • 2026-06-23: disclosed: CVE-2026-54761 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.