Executive brief
Traefik, a popular open-source edge router and load balancer, contains a security flaw in how it handles Kubernetes Gateway API configurations. An attacker with limited permissions could bypass security boundaries to reuse sensitive configuration settings (Middlewares) from other parts of the system. This could allow an attacker to impersonate other users or gain unauthorized access to internal applications by injecting fake identity information into web requests.
Technical details
A namespace confusion vulnerability exists in Traefik's Kubernetes Gateway API provider when resolving HTTPRoute extension references. The software incorrectly uses the backend Service namespace instead of the HTTPRoute namespace when processing 'HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef'. A low-privileged attacker with a ReferenceGrant for a cross-namespace Service can exploit this to bind a Traefik Middleware from that backend namespace without explicit authorization. This can be used to attach sensitive Middlewares, such as those that inject trusted reverse-proxy identity headers (e.g., X-WEBAUTH-USER), potentially leading to authentication bypass in downstream applications. The issue is fixed in version 3.7.7.
Affected products
- Traefik Labs Traefik >= 3.7.0, < 3.7.7
Timeline
- 2026-07-09: disclosed: Original advisory published by Traefik maintainers
- 2026-07-22: advisory: NVD and GitHub Advisory Database entries published
- 2026-08-05: patched: Advisory updated to reflect patch availability in 3.7.7