CVE-2026-65601

Analyzed Analyzed - Analysis Complete

Namespace Confusion in Traefik Kubernetes Gateway API

Publication date: 2026-07-22

Last updated on: 2026-08-06

Assigner: VulnCheck

Description

Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route author holding a ReferenceGrant for a cross-namespace Service could therefore bind a Traefik Middleware from the backend namespace without a separate grant for that middleware, potentially injecting trusted reverse-proxy identity headers into downstream requests. The issue is fixed in version 3.7.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-08-06

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-10

NVD

CVE-2026-65601

EUVD

EUVD-2026-47645

Affected Vendors & Products

Vendor	Product	Version / Range
traefik	traefik	From 3.7.0 (inc) to 3.7.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Traefik versions 3.7.0 through 3.7.6 have a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik incorrectly used the backend Service namespace instead of the HTTPRoute namespace. This allows a low-privileged route author with a ReferenceGrant for a cross-namespace Service to bind a Traefik Middleware from the backend namespace without separate permission for that middleware.

Detection Guidance

Check Traefik version with 'kubectl get pods -n <namespace> -l app.kubernetes.io/name=traefik -o jsonpath='{.items[0].spec.containers[0].image}''. If version is between 3.7.0 and 3.7.6, the system is vulnerable. Inspect HTTPRoute resources for extensionRef usage across namespaces.

Impact Analysis

An attacker could inject trusted reverse-proxy identity headers like X-WEBAUTH-USER: admin into downstream requests. Downstream applications may interpret these headers as valid user identities, potentially granting unauthorized access or elevating privileges.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized injection of authentication headers into downstream requests. If exploited, it may allow attackers to impersonate users or manipulate authenticated-identity state, which could violate data integrity and access control requirements under these regulations.

Mitigation Strategies

Upgrade Traefik to version 3.7.7 or later immediately. Review all HTTPRoute resources using extensionRef to ensure they reference middleware within the same namespace as the HTTPRoute.

Hi! I’m here to help you understand CVE-2026-65601. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70