Auth bypass in Traefik

CVE-2026-65601

Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespace…

Vulnerability class: Broken Access Control

Affected products

Traefik — versions 3.7.0, 3.7.7

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (patch)
disclosure@vulncheck.com (third-party-advisory)