Auth bypass in Traefik
CVE-2026-54761
Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.21 and 3.7.5, there is a high severity vulnerability in Traefik's Kubernetes Gateway provider affecting the crossProviderNamespaces allowlist. For HTTPRoute rules that declare multiple (WRR) backendRefs, Traefik evaluates the allowlist against the target backendRef.namespace instead of the route's own namespace. As a result, an HTTPRoute created in a namespace that is not allow-listed can reference a cross-provider TraefikService such as api@internal, dashboard@internal or rest@internal by pointing backendRef.namespace at an allow-listed namespace covered by a Gateway API ReferenceGrant, exposing internal Traefik services on the data plane. Exploitation requires the ability to create an accepted HTTPRoute and a matching ReferenceGrant from an allow-listed namespace; it does not require any change to Traefik static configuration, RBAC, or the deployment itself. This vulnerability is fixed in 3.6.21 and 3.7.5.
EPSS: 0.004 (30.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N.
Affected products
- Traefik — versions < 3.6.21, >= 3.7.0-ea.1, < 3.7.5
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Patch, Mitigation, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC, Release Notes)
- security-advisories@github.com (Patch, x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2026-54761?
- CVE-2026-54761 is a high-severity vulnerability in Traefik, classified under Improper Access Control. CVSS score: 7.1/10. Published 2026-06-23.
- How severe is CVE-2026-54761?
- High severity. CVSS v3 base score is 7.1 out of 10.
- Is CVE-2026-54761 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.