CVE-2026-54761: Traefik Auth Bypass Vulnerability

CVE-2026-54761 Overview

CVE-2026-54761 is an access control vulnerability [CWE-284] in Traefik, an HTTP reverse proxy and load balancer widely deployed in Kubernetes environments. The flaw affects the Kubernetes Gateway provider's crossProviderNamespaces allowlist enforcement. For HTTPRoute rules that declare multiple weighted round robin (WRR) backendRefs, Traefik evaluates the allowlist against the target backendRef.namespace instead of the route's own namespace. Attackers with the ability to create an accepted HTTPRoute and a matching ReferenceGrant from an allow-listed namespace can expose internal Traefik services such as api@internal, dashboard@internal, or rest@internal on the data plane. The vulnerability is fixed in versions 3.6.21 and 3.7.5.

Critical Impact
Attackers can expose internal Traefik services including the administrative dashboard and API endpoints to the data plane without modifying static configuration, RBAC, or the deployment itself.

Affected Products

Traefik versions prior to 3.6.21 (3.6.x branch)
Traefik versions prior to 3.7.5 (3.7.x branch)
Deployments using the Kubernetes Gateway API provider with crossProviderNamespaces enabled

Discovery Timeline

2026-06-23 - CVE-2026-54761 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-54761

Vulnerability Analysis

The vulnerability resides in Traefik's Kubernetes Gateway provider, which integrates with the Kubernetes Gateway API to route external traffic to backend services. The crossProviderNamespaces allowlist controls which namespaces are permitted to reference cross-provider Traefik services. These internal services include the administrative dashboard (dashboard@internal), the API (api@internal), and the REST configuration endpoint (rest@internal).

When an HTTPRoute declares multiple backendRefs for weighted round robin load balancing, Traefik incorrectly evaluates the allowlist using the backendRef.namespace field rather than the namespace of the HTTPRoute resource itself. This misplaced check allows a route in a non-allow-listed namespace to bypass the intended boundary by pointing its backend reference to a namespace that is allow-listed.

Root Cause

The root cause is an improper access control check [CWE-284] in the allowlist enforcement logic. The provider trusts the attacker-controlled backendRef.namespace value when determining whether a route is permitted to reference cross-provider services. The correct behavior is to evaluate the source namespace of the HTTPRoute itself.

Attack Vector

An attacker who can create HTTPRoute and ReferenceGrant resources in a tenant namespace can exploit this flaw. The attacker creates a multi-backend HTTPRoute and configures one backendRef to target a Traefik service such as api@internal while declaring its namespace as an allow-listed namespace. A matching ReferenceGrant in that allow-listed namespace authorizes the cross-namespace reference under Gateway API semantics. Traefik then accepts the route and exposes the internal service on the data plane. Exploitation requires no change to Traefik static configuration, no RBAC modification, and no redeployment.

The vulnerability mechanism is documented in the GitHub Security Advisory GHSA-3g6v-2r68-prfc.

Detection Methods for CVE-2026-54761

Indicators of Compromise

HTTPRoute resources containing multiple backendRefs where one entry references api@internal, dashboard@internal, or rest@internal
Unexpected ReferenceGrant resources in allow-listed namespaces authorizing traffic from tenant namespaces
Unsolicited HTTP traffic to data plane routes returning Traefik dashboard or API responses

Detection Strategies

Audit all HTTPRoute manifests across the cluster for backendRef entries referencing internal Traefik service names
Inventory ReferenceGrant resources and verify each grant aligns with documented multi-tenant boundaries
Compare the namespace of each HTTPRoute against the configured crossProviderNamespaces allowlist to identify routes that should not have cross-provider access

Monitoring Recommendations

Enable Kubernetes audit logging for create and update events on HTTPRoute and ReferenceGrant objects
Alert on data plane HTTP requests that resolve to /api, /dashboard, or other internal Traefik paths from external clients
Forward Traefik access logs and Kubernetes audit events into a centralized analytics platform such as Singularity Data Lake for correlation and retroactive hunting

How to Mitigate CVE-2026-54761

Immediate Actions Required

Upgrade Traefik to version 3.6.21 or 3.7.5 immediately
Inventory existing HTTPRoute resources for references to api@internal, dashboard@internal, and rest@internal
Restrict cluster RBAC so that only trusted administrators can create HTTPRoute and ReferenceGrant resources in allow-listed namespaces

Patch Information

Traefik released fixed versions on the 3.6.x and 3.7.x branches. Review the GitHub Release v3.6.21 and GitHub Release v3.7.5 for upgrade notes. The advisory is published at GHSA-3g6v-2r68-prfc.

Workarounds

Disable the crossProviderNamespaces feature if cross-provider references are not required
Remove or tighten the allowlist to exclude namespaces where untrusted users can create ReferenceGrant resources
Disable the Traefik dashboard, API, and REST endpoints in production by removing the --api and --api.dashboard flags from the static configuration

bash

# Verify installed Traefik version and upgrade via Helm
kubectl exec -n traefik deploy/traefik -- traefik version
helm repo update
helm upgrade traefik traefik/traefik --version 3.7.5 -n traefik

# Audit HTTPRoutes for references to internal Traefik services
kubectl get httproute -A -o json | \
  jq '.items[] | select(.spec.rules[].backendRefs[]?.name | test("internal"))'