Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion

Summary There is a medium-severity namespace-confusion vulnerability in Traefik's Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules.backendRefs.filters.extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route author...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through improper namespace resolution in the extensionRef process. An attacker can cause unauthorized middleware from a backend namespace to be bound to a route by crafting a malicious HTTPRoute with...

CVE-2026-65601 Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef

Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules.backendRefs.filters.extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route auth...

CVE-2026-65601 Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef

Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules.backendRefs.filters.extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route auth...

CVE-2026-65601 Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef

Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules.backendRefs.filters.extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route auth...

CVE-2026-65601

Summary (concrete details from provided sources): Traefik versions 3.7.0–3.7.6 contain a namespace-confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespace instead of the ...

CVE-2026-65601

Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules.backendRefs.filters.extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route auth...

PT-2026-68942

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qq9q-x9w4-chhj. This link is maintained to preserve external references. Original Description Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API...

GO-2026-5760 Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding in github.com/traefik/traefik

Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding in github.com/traefik/traefik...

CVE-2026-41174

Summary: CVE-2026-41174 affects Traefik’s Kubernetes CRD provider where cross-namespace isolation is breached for nested Chain middlewares, allowing an actor with CRD permissions in their own namespace to cause Traefik to apply middleware from another namespace. The issue occurs when providers.ku...