Kubernetes Gateway Provider Vulnerability in Traefik by Traefik Labs

CVE-2026-54761

What is CVE-2026-54761?

A vulnerability exists in Traefik's Kubernetes Gateway provider that affects the handling of the crossProviderNamespaces allowlist. Specifically, for HTTPRoute rules that declare multiple backendRefs, Traefik incorrectly checks the allowlist against the target backendRef.namespace rather than the namespace of the HTTPRoute itself. This oversight allows an HTTPRoute located in a non-allow-listed namespace to reference a cross-provider TraefikService—including services like api@internal, dashboard@internal, or rest@internal—through a backendRef pointing to an allow-listed namespace covered by a Gateway API ReferenceGrant. Exploiting this flaw necessitates the ability to create an acceptable HTTPRoute and a corresponding ReferenceGrant from an allow-listed namespace, with no requirement for alterations to the Traefik static configuration or deployment setup. This issue has been resolved in Traefik versions 3.6.21 and 3.7.5.

References