6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54761

CVE-2026-54761: Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services

Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.21 and 3.7.5, there is a high severity vulnerability in Traefik's Kubernetes Gateway provider affecting the crossProviderNamespaces allowlist. For HTTPRoute rules that declare multiple (WRR) backendRefs, Traefik evaluates the allowlist against the target backendRef.namespace instead of the route's own namespace. As a result, an HTTPRoute created in a namespace that is not allow-listed can reference a cross-provider TraefikService such as api@internal, dashboard@internal or rest@internal by pointing backendRef.namespace at an allow-listed namespace covered by a Gateway API ReferenceGrant, exposing internal Traefik services on the data plane. Exploitation requires the ability to create an accepted HTTPRoute and a matching ReferenceGrant from an allow-listed namespace; it does not require any change to Traefik static configuration, RBAC, or the deployment itself. This vulnerability is fixed in 3.6.21 and 3.7.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54761

CVE-2026-54761:

6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/traefik/traefik/v3	go	<= 3.6.20	3.6.21
github.com/traefik/traefik/v2	go	<= 2.11.50
github.com/traefik/traefik	go	<= 1.7.34
github.com/traefik/traefik/v3	go	>= 3.7.0-ea.1, <= 3.7.4	3.7.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in Traefik's Kubernetes Gateway provider, specifically in how it handles crossProviderNamespaces for HTTPRoute, TCPRoute, and TLSRoute with multiple backendRefs. The core issue is that when multiple backends are defined, the validation to check if a route is allowed to reference a cross-provider service (like api@internal) was using the namespace defined in the backendRef (backendRef.namespace) instead of the namespace of the route itself (route.Namespace).

This allowed an attacker who can create a route in a non-privileged namespace to still access and expose internal Traefik services by creating a route with multiple backendRefs, where one of them points to a legitimate service and the other points to an internal Traefik service, but with the namespace field in the backendRef pointing to a namespace that is in the crossProviderNamespaces allowlist. The ReferenceGrant mechanism in Kubernetes Gateway API would allow this cross-namespace reference, and Traefik's vulnerable logic would then incorrectly authorize the request.

The patch addresses this by explicitly disallowing the use of backendRef.namespace when the backendRef is a cross-provider service (i.e., contains an '@'). This ensures that for cross-provider services, the check is always performed against the route's own namespace, correctly enforcing the crossProviderNamespaces security boundary.

Vulnerable functions

Provider.loadService

pkg/provider/kubernetes/gateway/httproute.go

The `loadService` function in `httproute.go` was vulnerable because it used the `backendRef.Namespace` to check against the `crossProviderNamespaces` allowlist when dealing with multiple `backendRefs`. This allowed an `HTTPRoute` in a non-allow-listed namespace to bypass the restriction by pointing to an allow-listed namespace in the `backendRef`. The patch mitigates this by adding a check that rejects cross-provider references when a `backendRef.Namespace` is specified.

Provider.loadTCPService

pkg/provider/kubernetes/gateway/tcproute.go

Similar to `loadService`, the `loadTCPService` function in `tcproute.go` was vulnerable. It incorrectly used the `backendRef.Namespace` for the `crossProviderNamespaces` check, allowing a `TCPRoute` in a disallowed namespace to expose internal services. The patch adds a check to reject cross-provider references when `backendRef.Namespace` is specified.

Provider.loadTLSService

pkg/provider/kubernetes/gateway/tlsroute.go

The `loadTLSService` function in `tlsroute.go` had the same vulnerability as the other `load*Service` functions. It used the `backendRef.Namespace` for the security check, which could be manipulated to bypass the `crossProviderNamespaces` allowlist. The patch mitigates this by rejecting cross-provider references that specify a `backendRef.Namespace`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.