CVE-2026-54761: Traefik Kubernetes Gateway Namespace Bypass Allows Internal Service Exposure

Technical summary

The vulnerability resides in the Kubernetes Gateway provider's handling of the crossProviderNamespaces allowlist when HTTPRoute resources declare weighted round-robin (WRR) backend references. During policy evaluation, Traefik incorrectly validates the allowlist against the backendRef.namespace field rather than the HTTPRoute's own namespace. An attacker can craft an HTTPRoute in a non-whitelisted namespace that references internal TraefikServices (api@internal, dashboard@internal, rest@internal) by specifying a backendRef.namespace pointing to an allow-listed namespace. When coupled with a ReferenceGrant from the allow-listed namespace, the misconfigured access control permits the internal service to be exposed on the data plane. The flaw requires no modification to static configuration, RBAC policies, or pod permissions.

Business impact

Exposure of Traefik's internal administrative interfaces—API, dashboard, and REST services—can enable unauthorized operational oversight, configuration disclosure, and potential lateral movement within Kubernetes clusters. An attacker who gains unauthenticated or low-privilege access to these endpoints may enumerate routes, view secrets, modify traffic policies, or gather intelligence for follow-on attacks. For organizations operating multi-tenant Kubernetes environments or using Traefik as a gateway between trust boundaries, this vulnerability materially weakens namespace isolation guarantees and could violate compliance postures regarding data compartmentalization.

Affected systems

Traefik versions 3.6.x prior to 3.6.21 and 3.7.x prior to 3.7.5 are vulnerable. Organizations running Traefik as a Kubernetes Gateway API provider with the crossProviderNamespaces allowlist feature enabled are at risk. The vulnerability does not affect installations that (a) do not use the Kubernetes Gateway provider, (b) do not rely on namespace-based access controls, or (c) have upgraded to patched versions.

Exploitability

Exploitation is feasible for any principal with permission to create HTTPRoute resources in a non-allow-listed namespace and the ability to coordinate with an allow-listed namespace to create a matching ReferenceGrant. No authentication bypass, privilege escalation, or code injection is required; the attack leverages misconfigured policy enforcement. In shared or multi-tenant Kubernetes clusters where developers have broad HTTPRoute creation rights, the attack surface is substantial. The CVSS score of 7.1 (High) reflects the requirement for authenticated access and lack of direct impact on availability, though confidentiality and integrity risks are significant.

Remediation

Upgrade Traefik to version 3.6.21 or later for the 3.6.x branch, or to version 3.7.5 or later for the 3.7.x branch. Verify against the vendor's release notes to confirm the patch addresses the crossProviderNamespaces validation logic. Organizations unable to patch immediately should restrict HTTPRoute and ReferenceGrant creation rights via Kubernetes RBAC, disable the crossProviderNamespaces allowlist if not required, or isolate Traefik's internal endpoints from network exposure.

Patch guidance

Apply the latest patch from the Traefik project: 3.6.21 for the 3.6 series and 3.7.5 for the 3.7 series. Review your Traefik Helm values or Kubernetes manifests to confirm the Gateway provider is enabled and crossProviderNamespaces rules are in use before patching, as the vulnerability only manifests in that configuration. After patching, validate that HTTPRoute policies correctly validate the route namespace rather than the backend reference namespace, and test that internal services are no longer accessible from non-allow-listed namespaces.

Detection guidance

Monitor for HTTPRoute resources created in namespaces not listed in the crossProviderNamespaces allowlist that reference internal services (api@internal, dashboard@internal, rest@internal) via backendRef.namespace fields pointing to allow-listed namespaces. Audit ReferenceGrant objects that permit cross-namespace references from non-allow-listed namespaces to internal services. Enable Traefik access logs and Kubernetes API audit logs to identify requests to internal endpoints originating from unexpected namespaces. Search for patterns where backendRef.namespace differs from the HTTPRoute's own namespace in multi-backend route definitions.

Why prioritize this

This vulnerability merits immediate patching due to the combination of high confidentiality impact (internal service exposure), straightforward exploitability for authenticated users, and the broad reliance on Kubernetes namespace isolation in multi-tenant deployments. Organizations with shared Kubernetes clusters or strict namespace-based trust boundaries should treat this as a critical update. The lack of KEV status does not diminish urgency; the misconfiguration is easily discoverable and exploitable without sophisticated tooling.

Risk score, explained

The CVSS 3.1 score of 7.1 (High) captures a network-accessible flaw requiring low privilege (HTTPRoute creation rights) and no user interaction. The vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N reflects high confidentiality impact (exposure of internal APIs and dashboards), limited integrity risk (potential for configuration tampering), and no direct availability impact. The score does not account for organizational context: in multi-tenant environments or clusters with broad developer permissions, practical risk is elevated.

Frequently asked questions