CVE-2026-54765

Received Received - Intake

Traefik Kubernetes Gateway API Provider Security Filter Misconfiguration

Publication date: 2026-07-06

Last updated on: 2026-07-06

Assigner: GitHub, Inc.

Description

Traefik is an open source HTTP reverse proxy and load balancer. From v3.7.0 prior to v3.7.6, Traefik's Kubernetes Gateway API provider may resolve two accepted HTTPRoutes that target the same backend Service:port but configure different backendRef filters to the same child service and apply only one route's filter set to all requests reaching that backend. In Gateway deployments where backendRef filters set security-sensitive headers, such as tenant identity, authorization context, or values the backend trusts, an attacker who can create an accepted HTTPRoute sharing the same backend Service:port may cause their route's filter context to be applied to another route's requests, potentially crossing namespace boundaries when a ReferenceGrant permits cross-namespace targeting. This issue is fixed in version v3.7.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-06

Last Modified

2026-07-06

Generated

2026-07-07

AI Q&A

2026-07-07

EPSS Evaluated

N/A

NVD

CVE-2026-54765

Affected Vendors & Products

Vendor	Product	Version / Range
traefik	traefik	to 3.7.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability affects Traefik versions from 3.7.0 up to but not including 3.7.6, specifically in its Kubernetes Gateway API provider. The issue arises when two accepted HTTPRoutes target the same backend Service:port but have different backendRef filters configured. Instead of applying each route's filter set separately, Traefik applies only one route's filter set to all requests reaching that backend.

If backendRef filters set security-sensitive headers such as tenant identity or authorization context, an attacker who can create an accepted HTTPRoute sharing the same backend Service:port may cause their route's filter context to be applied to requests from another route. This can potentially cross namespace boundaries if a ReferenceGrant allows cross-namespace targeting.

This means that security-sensitive information or controls intended for one route could be incorrectly applied to another, leading to unauthorized access or information leakage.

Impact Analysis

The vulnerability can lead to security-sensitive headers being incorrectly applied across different HTTP routes sharing the same backend Service:port. This may allow an attacker to manipulate or gain unauthorized access to tenant identity, authorization contexts, or other trusted values.

Such unauthorized application of filters can result in cross-namespace data leakage or privilege escalation, potentially compromising the security boundaries between different tenants or services.

Mitigation Strategies

The vulnerability is fixed in Traefik version v3.7.6. The immediate step to mitigate this vulnerability is to upgrade Traefik to version v3.7.6 or later.

Hi! I’m here to help you understand CVE-2026-54765. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70