Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.0
CVE-2026-65601: Traefik 3.7.0‑3.7.6 may let low‑privilege users attach middleware
CVE-2026-65601 · published 3 months ago
Summary
Versions of Traefik from 3.7.0 through 3.7.6 can mix up the namespace of a routing rule, letting a user who only has permission to reference a service in another namespace also attach a middleware from the service’s own namespace. This could allow that user to add trusted identity information to traffic passing through the proxy. Upgrade to Traefik 3.7.7 or later to stop the mix‑up.
What to do
- Update traefik to version 3.7.7.
- Update traefik traefik to version 3.7.7 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | traefik | traefik |
< 3.7.7 >= 3.7.0, < 3.7.7 |
| go | – | traefik |
>= 3.7.0, < 3.7.7 Fix: upgrade to 3.7.7
|
Original advisory text
Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef
Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route author holding a ReferenceGrant for a cross-namespace Service could therefore bind a Traefik Middleware from the backend namespace without a separate grant for that middleware, potentially injecting trusted reverse-proxy identity headers into downstream requests. The issue is fixed in version 3.7.7.
References
- https://github.com/traefik/traefik/pull/13462
- https://github.com/traefik/traefik/commit/655d6324ab4a1475892a958d4bae389720a67e...
- https://github.com/advisories/GHSA-qq9q-x9w4-chhj
- https://nvd.nist.gov/vuln/detail/CVE-2026-65601 Vendor Advisory
- https://github.com/traefik/traefik/commit/26c96a3935cafb473f4a5bae1886560d9aa4e4... Patch
- https://www.vulncheck.com/advisories/traefik-before-namespace-confusion-via-http... Vendor Advisory
- https://github.com/traefik/traefik/security/advisories/GHSA-qq9q-x9w4-chhj Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65601... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.0
High
Type
CWE-863Incorrect Authorization
Timeline
Published22 Jul 2026
Updated4 Nov 2026
First seen22 Jul 2026
Track software like this
Free during beta