CVE-2026-65601

High

Description

Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route author holding a ReferenceGrant for a cross-namespace Service could therefore bind a Traefik Middleware from the backend namespace without a separate grant for that middleware, potentially injecting trusted reverse-proxy identity headers into downstream requests. The issue is fixed in version 3.7.7.

SeverityHigh

CVSS8.8

Exploit probability—

Product

Traefik

PublishedJul 22, 2026

First seenJul 22, 2026

Weakness typeCWE-863Incorrect authorization

How to fix

Update

traefik traefik3.7.7 or later
Traefik3.7.7 or later

Patches

github.com/traefik/traefik/commit/26c96a3935cafb473f4a5bae1886560d9aa4e4f0

Vendor advisories

github.com/traefik/traefik/security/advisories/GHSA-qq9q-x9w4-chhj

Affected products

Product	Affected versions	Fixed in
traefik traefik	3.7.0 ≤ v < 3.7.7	3.7.7
TraefikGo	3.7.0 ≤ v < 3.7.7	3.7.7
github.com/traefik/traefikGo	No range specified	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.