CVE-2026-53718

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRoute can use an extension-managed custom backendRef to reference a backend resource in another namespace without a matching Gateway API...

CVE-2026-53718 Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRoute can use an extension-managed custom backendRef to reference a backend resource in another namespace without a matching Gateway API...

CVE-2026-53718

Envoy Gateway prior to 1.7.4 and 1.8.1 contains a cross-namespace authorization bypass in the custom-backend branch of internal/gatewayapi/route.go. The omitted validateBackendNamespace check allows an HTTPRoute to use an extension-managed custom backendRef to reference a backend resource in anot...

CVE-2026-53718 Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRoute can use an extension-managed custom backendRef to reference a backend resource in another namespace without a matching Gateway API...

CVE-2026-53718 Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRoute can use an extension-managed custom backendRef to reference a backend resource in another namespace without a matching Gateway API...

EUVD-2026-78072

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRoute can use an extension-managed custom backendRef to reference a backend resource in another namespace without a matching Gateway API...

CVE-2026-53718

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRoute can use an extension-managed custom backendRef to reference a backend resource in another namespace without a matching Gateway API...

GO-2026-6205 Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port in github.com/traefik/traefik

Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port in github.com/traefik/traefik...

GO-2026-6198 Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion

Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...

GO-2026-6203 Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef in github.com/traefik/traefik

Traefik: allowCrossNamespace=false bypass via @kubernetescrd TraefikService backendRef in github.com/traefik/traefik...

PT-2026-80433

Traefik: allowCrossNamespace=false bypass via @kubernetescrd TraefikService backendRef in github.com/traefik/traefik...

PT-2026-80429

Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...

PT-2026-80435

Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port in github.com/traefik/traefik...

Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port

Summary There is a medium severity vulnerability in Traefik's Kubernetes Gateway API provider. When two accepted HTTPRoutes target the same backend Service:port but configure different backendRef filters, Traefik may resolve both routes to the same child service and apply only one route's filter...

GHSA-6P8F-P8J2-RQMV Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port

Summary There is a medium severity vulnerability in Traefik's Kubernetes Gateway API provider. When two accepted HTTPRoutes target the same backend Service:port but configure different backendRef filters, Traefik may resolve both routes to the same child service and apply only one route's filter...

CVE-2026-71325

Traefik exposes a cross-namespace bypass for TraefikService backends via @kubernetescrd references. The CVE affects Traefik’s Kubernetes CRD service resolver: when the reference name contains an @kubernetescrd, the resolver’s guard for cross-namespace references is not enforced for TraefikService...

CVE-2026-71325 Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef

Traefik is an open-source edge router that makes publishing services a fun and easy experience. Prior to 2.11.54, 3.6.25, and 3.7.10, cross-namespace @kubernetescrd references are not rejected for TraefikService backend references resolved by the service resolver. A tenant confined by RBAC to a...

CVE-2026-54761

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. This vulnerability exists in the Kubernetes Gateway provider's crossProviderNamespaces allowlist. A remote attacker with the ability to create an accepted HTTPRoute and a matching ReferenceGrant can exploit this by misconfiguri...

GHSA-6MXQ-JR92-3H2R Duplicate Advisory: Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qq9q-x9w4-chhj. This link is maintained to preserve external references. Original Description Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API...

GO-2026-6007 Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass in github.com/envoyproxy/gateway

Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass in github.com/envoyproxy/gateway...