High severity · published Jul 22, 2026
CVE-2026-65601
Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route author holding a ReferenceGrant for a cross-namespace Service could therefore bind a Traefik Middleware from the backend namespace without a separate grant for that middleware, potentially injecting trusted reverse-proxy identity headers into downstream requests. The issue is fixed in version 3.7.7.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TR
traefik · traefik
3.7.0 before 3.7.7 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-65601
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-65601
vendor-advisory
https://github.com/traefik/traefik/security/advisories/GHSA-qq9q-x9w4-chhj
patch
https://github.com/traefik/traefik/commit/26c96a3935cafb473f4a5bae1886560d9aa4e4f0
third-party-advisory
https://www.vulncheck.com/advisories/traefik-before-namespace-confusion-via-httproute-extensionref
More from traefik
10.0
CVE-2026-54763
Traefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
10.0
CVE-2026-53622
Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts
10.0
CVE-2026-48491
Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass
10.0
CVE-2026-48020
Traefik StripPrefix Route-Level Auth Bypass via Path Normalization
10.0
CVE-2026-39858
Traefik: Forwarded alias spoofing top pre-auth decision bypass