Listen to this Post
CVE-2026-65601 is a namespace confusion vulnerability affecting Traefik versions 3.7.0 through 3.7.6 in the Kubernetes Gateway API provider. The flaw resides in how Traefik resolves `HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef` – instead of using the HTTPRoute’s own namespace for filter resolution, Traefik incorrectly uses the namespace of the backend Service referenced in the route.
This logic error creates a dangerous privilege escalation vector. In Kubernetes, the Gateway API ReferenceGrant mechanism allows a namespace owner to grant a route in another namespace permission to reference a specific backend object (such as a Service). This grant is intended to be narrowly scoped to that specific backend resource. However, due to the namespace confusion, Traefik reuses the backend Service namespace when resolving `extensionRef` filters attached to that backend.
Concretely, when Traefik processes an HTTPRoute, it copies `backendRef.namespace` into a local variable. It correctly uses that namespace to validate and load the backend Service, but then reuses the same namespace when resolving backendRef.filters[].extensionRef. For Traefik CRD Middleware extension filters, the CRD provider turns `(namespace, name)` into a dynamic middleware reference such as platform-privileged-auth-header@kubernetescrd.
As a result, a low-privileged route author in namespace `tenant-a` who holds a ReferenceGrant only for `platform/protected-api` Service can bind a Traefik Middleware named `privileged-auth-header` from the `platform` namespace – even though the ReferenceGrant never authorized access to that middleware. This effectively allows the attacker to inject arbitrary middleware from a foreign namespace into their own routes.
The injected middleware can set trusted reverse-proxy identity headers such as X-WEBAUTH-USER: admin. Many downstream applications (Grafana, Gitea, Jenkins, SonarQube, Nexus Repository) support header-based authentication when deployed behind a reverse proxy. An attacker can therefore impersonate any user by setting the appropriate header, bypassing authentication controls entirely.
The vulnerability is fixed in Traefik version 3.7.7, which resolves `extensionRef` against the HTTPRoute namespace instead of the backend Service namespace. The fix is implemented in commits `655d632` and 26c96a3. No public proof-of-concept exploit has been published, but the attack complexity is low and requires only a low-privileged user with a valid ReferenceGrant.
DailyCVE Form:
Platform: Kubernetes (Traefik)
Version: 3.7.0 – 3.7.6
Vulnerability: Namespace Confusion (CWE-863)
Severity: Critical (CVSS 5.3 / 7.5)
Date: 2026-07-22
Prediction: 2026-07-22
What Undercode Say:
CVSS v3.1 Base Score: 5.3 (Medium) – AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0 Score: 5.3 (Medium)
EPSS Score: 0.41% – 0.00238
CWE ID: CWE-863 (Incorrect Authorization)
CISA KEV Status: Not Listed
Exploit Status: No public PoC available
Attack Vector: Network
Privileges Required: Low
User Interaction: None
Scope: Changed
Bash Commands & Code:
Check current Traefik version
kubectl get deployment traefik -n traefik -o jsonpath='{.spec.template.spec.containers[bash].image}'
Upgrade to patched version 3.7.7
kubectl set image deployment/traefik traefik=traefik:3.7.7 -n traefik
Helm upgrade
helm upgrade traefik traefik/traefik --set image.tag=3.7.7
Verify all Traefik pods are running version 3.7.7
kubectl get pods -n traefik -o jsonpath='{range .items[]}{.metadata.name}{"\t"}{.spec.containers[bash].image}{"\n"}{end}'
Vulnerable HTTPRoute Example (Attack):
apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: attacker-route namespace: tenant-a spec: rules: - backendRefs: - name: protected-api namespace: platform port: 80 filters: - type: ExtensionRef extensionRef: group: traefik.io kind: Middleware name: privileged-auth-header from platform namespace
Patched Resolution (Fix):
// Before (vulnerable): middlewares, err := p.loadMiddlewares(conf, namespace, serviceName, backendRef.Filters, pathMatch) // After (fixed): middlewares, err := p.loadMiddlewares(conf, route.Namespace, serviceName, backendRef.Filters, pathMatch)
Commit: `655d632`
Exploit:
A low-privileged route author with a valid ReferenceGrant for a cross-namespace Service can craft an HTTPRoute that references a Traefik Middleware from the backend Service’s namespace. Since Traefik resolves the middleware using the backend namespace rather than the HTTPRoute namespace, the middleware is loaded and applied to the route even though no explicit grant exists for that middleware.
The attacker can then use the injected middleware to set arbitrary trusted reverse-proxy headers (e.g., X-WEBAUTH-USER: admin, X-Remote-User: root). Downstream applications that trust these headers for authentication will accept the attacker-supplied identity, granting unauthorized access to sensitive resources.
Protection:
- Immediate: Upgrade Traefik to version 3.7.7 or later.
- Workaround: Restrict HTTPRoute creation and management to trusted administrators only.
- Audit: Review all existing ReferenceGrant policies and ensure they are narrowly scoped to specific Services.
- Policy Enforcement: Deploy Kyverno or OPA Gatekeeper policies to block cross-namespace HTTPRoutes that use ExtensionRef filters.
- Monitoring: Monitor Traefik logs for unexpected middleware bindings or namespace resolution anomalies.
Impact:
Successful exploitation allows an attacker to bypass Kubernetes namespace isolation and bind arbitrary middleware from protected namespaces. The most severe impact is the injection of trusted reverse-proxy identity headers, enabling authentication bypass in downstream applications that support header-based auth (Grafana, Gitea, Jenkins, SonarQube, Nexus Repository). This can lead to unauthorized access to sensitive data, privilege escalation within the cluster, and lateral movement across namespaces. While not a direct RCE or sandbox escape, the vulnerability effectively undermines the entire namespace-based security model of Kubernetes Gateway API.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
