CVE-2026-65601: Traefik Privilege Escalation Vulnerability

CVE-2026-65601 Overview

CVE-2026-65601 is a namespace confusion vulnerability [CWE-863] in the Traefik reverse proxy affecting the Kubernetes Gateway API provider. Traefik versions 3.7.0 through 3.7.6 resolve HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef using the backend Service namespace rather than the HTTPRoute namespace. A low-privileged route author with a ReferenceGrant for a cross-namespace Service can bind a Traefik Middleware from the backend namespace without a separate grant covering that middleware. The attacker can inject trusted reverse-proxy identity headers into downstream requests. Traefik version 3.7.7 resolves the issue.

Critical Impact
A route author with only a cross-namespace Service grant can attach arbitrary middlewares from the backend namespace, enabling identity header injection into downstream applications that trust Traefik-inserted headers.

Affected Products

Traefik 3.7.0 through 3.7.6
Deployments using the Kubernetes Gateway API provider
Multi-tenant clusters relying on ReferenceGrant for cross-namespace routing

Discovery Timeline

2026-07-22 - CVE-2026-65601 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-65601

Vulnerability Analysis

Traefik integrates with the Kubernetes Gateway API to route external traffic to in-cluster services. The Gateway API permits HTTPRoute resources to reference backend Services in other namespaces when a corresponding ReferenceGrant authorizes the cross-namespace binding. Traefik extends HTTPRoute filters through extensionRef, which can point at a Traefik Middleware resource.

The vulnerable code resolves the extensionRef object using the backend Service's namespace as the lookup context, not the namespace of the HTTPRoute declaring the filter. As a result, the authorization boundary that ReferenceGrant is meant to enforce is bypassed for middlewares. An author who owns an HTTPRoute in one namespace, and who has been granted access to a Service in a second namespace, can silently attach any Middleware present in that second namespace.

Root Cause

The defect is an authorization decision made against the wrong namespace scope [CWE-863]. Cross-namespace attachment of a Middleware via extensionRef requires its own ReferenceGrant, but Traefik never checks for one. The patch in version 3.7.7 corrects the namespace used during extensionRef resolution and enforces the required grant.

Attack Vector

An attacker with permission to create HTTPRoute resources in namespace A and holding a ReferenceGrant for a Service in namespace B crafts an HTTPRoute whose filter extensionRef names a Traefik Middleware from namespace B. Traefik binds that middleware to the route. If the middleware sets headers such as X-Forwarded-User, X-Authenticated-User, or similar trust markers, downstream applications receive spoofed identity headers from a source they trust.

The patch is tracked in the Traefik repository via the GitHub commit 26c96a3 and the GHSA-qq9q-x9w4-chhj advisory. No public proof-of-concept exploit code is available at this time.

Detection Methods for CVE-2026-65601

Indicators of Compromise

HTTPRoute resources whose backendRefs[].filters[].extensionRef targets a Middleware in a namespace different from the route's namespace.
Presence of ReferenceGrant objects that authorize Service access without a corresponding grant for Middleware kinds.
Unexpected identity headers such as X-Forwarded-User or X-Authenticated-User arriving at backend applications from Traefik.

Detection Strategies

Inventory all HTTPRoute resources across the cluster and flag any extensionRef that crosses namespace boundaries relative to the route's namespace.
Audit Traefik logs for middleware attachments referencing namespaces outside the route's own namespace.
Compare inbound request headers at backend Services against expected values to identify header spoofing.

Monitoring Recommendations

Enable Kubernetes audit logging for HTTPRoute, Middleware, and ReferenceGrant create and update events.
Alert when a low-privileged service account modifies HTTPRoute resources with extensionRef fields.
Track the running Traefik image version and alert when the deployment is not on 3.7.7 or later.

How to Mitigate CVE-2026-65601

Immediate Actions Required

Upgrade Traefik to version 3.7.7 or later in all clusters using the Kubernetes Gateway API provider.
Review existing HTTPRoute resources for cross-namespace extensionRef values and remove untrusted references.
Restrict HTTPRoute create and update permissions to trusted route authors through Kubernetes RBAC.

Patch Information

The fix is included in Traefik 3.7.7. The upstream commit is available at the Traefik GitHub commit 26c96a3. Full remediation details are in the Traefik GHSA-qq9q-x9w4-chhj advisory and the VulnCheck advisory.

Workarounds

Disable use of extensionRef in HTTPRoute filters until the upgrade is completed.
Remove Middleware resources from namespaces that host cross-namespace-referenced Services when they are not required.
Do not rely on Traefik-inserted identity headers for authentication decisions in downstream applications; enforce authentication at the application layer.

bash

# Verify running Traefik version and identify cross-namespace extensionRef usage
kubectl get pods -A -l app.kubernetes.io/name=traefik -o jsonpath='{range .items[*]}{.metadata.namespace}{"/"}{.metadata.name}{"\t"}{.spec.containers[*].image}{"\n"}{end}'

# List HTTPRoutes and inspect extensionRef entries
kubectl get httproutes.gateway.networking.k8s.io -A -o json \
  | jq '.items[] | {ns: .metadata.namespace, name: .metadata.name, refs: .spec.rules[]?.backendRefs[]?.filters[]?.extensionRef}'