CVE-2026-65601

UNKNOWN 0.0

Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route author holding a ReferenceGrant for a cross-namespace Service could therefore bind a Traefik Middleware from the backend namespace without a separate grant for that middleware, potentially injecting trusted reverse-proxy identity headers into downstream requests. The issue is fixed in version 3.7.7.

CWE	CWE-863
Vendor	traefik
Product	traefik
Published	Jul 22, 2026

Stay Ahead of the Next One

Get instant alerts for traefik traefik

Be the first to know when new unknown vulnerabilities affecting traefik traefik are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

traefik / traefik

3.7.0 < 3.7.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/traefik/traefik/security/advisories/GHSA-qq9q-x9w4-chhj github.com: https://github.com/traefik/traefik/commit/26c96a3935cafb473f4a5bae1886560d9aa4e4f0 vulncheck.com: https://www.vulncheck.com/advisories/traefik-before-namespace-confusion-via-httproute-extensionref

Credits

🔍 CuB3y0nd