Saku0512/CVE-2026-54761-poc

GitHubRepository PoCExploit

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Proof of Concept (PoC) exploit for CVE-2026-54761. It provides a script and Kubernetes manifests to create a local kind cluster running a vulnerable version of Traefik (v3.7.1) and demonstrates a crossProviderNamespaces bypass. The exploit route uses multiple weighted backendRefs to expose the internal api@internal service from an unauthorized namespace, while a control route with a single backendRef is correctly blocked.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of documentation and a Kubernetes manifest for a CVE-2026-54761 proof-of-concept. The README files describe the vulnerability and how to run the PoC in a local kind cluster. The gateway-exploit.yaml manifest defines namespaces, a deployment, a service, a ReferenceGrant, a Gateway, and two HTTPRoutes that demonstrate the authorization bypass. No backdoor, deceptive payload, or concealed operator-directed harm is present in the reviewed text. The artifact is a straightforward educational PoC that exploits the described CVE against a local Traefik instance.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesShellYAMLMarkdown
Target softwareTraefik
Attack typesAuthorization BypassInformation Disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is classified as an exploit because it includes a complete, executable script and Kubernetes manifests designed to actively exercise the vulnerability by deploying a vulnerable Traefik instance and triggering the bypass to expose an internal service. The README explicitly describes it as a 'Proof of Concept' that demonstrates the vulnerability in an isolated environment.

README.en.md:6README.en.md:60-69README.en.md:100-108

Requirements

  • Ability to create an HTTPRoute in an unauthorized namespace and a matching ReferenceGrant in an authorized namespace.README.en.md:8
  • Traefik Kubernetes Gateway provider configured with a crossProviderNamespaces allowlist.README.en.md:66

Observed behavior

  • Creates a local kind cluster with Traefik v3.7.1 and Gateway API CRDs.README.en.md:62-66
  • Deploys a control HTTPRoute with a single backendRef to api@internal from the 'attacker' namespace, which is expected to return a 404 error.README.en.md:94-98
  • Deploys an exploit HTTPRoute with multiple weighted backendRefs, including api@internal, from the 'attacker' namespace, which successfully exposes the Traefik API.README.en.md:100-108
  • The exploit route's backendRefs include a TraefikService pointing to api@internal in the 'trusted' namespace and a regular Service in the 'attacker' namespace.external-repro-kind/gateway-exploit.yaml:116-127
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Cve Reference
CVE-2026-54761The artifact is a PoC for this specific Traefik vulnerability, as stated in the README files.README.en.md:6
Execution Instruction
cd external-repro-kind && ./run-kind-repro.shThe README instructs the user to run a shell script to reproduce the vulnerability in a local kind cluster. The script itself is not included in the reviewed evidence.README.en.md:80-82
Kubernetes Manifest
external-repro-kind/gateway-exploit.yamlThis manifest creates the resources needed to demonstrate the CVE, including an HTTPRoute that bypasses the crossProviderNamespaces allowlist.external-repro-kind/gateway-exploit.yaml:1-127
Review boundaries

What the analysis did not establish

  • The evidence packet does not include the content of the shell script 'run-kind-repro.sh' or the YAML files 'kind-config.yaml' and 'traefik-v371.yaml', which are necessary for the full end-to-end reproduction. Only the README files and the 'gateway-exploit.yaml' manifest are provided.
  • The run-kind-repro.sh script and other YAML files (kind-config.yaml, traefik-v371.yaml) are not included in the reviewed text. Their contents are unknown and could contain backdoor behavior not visible in the supplied evidence.
  • Binary files are reported as present but not analyzed; their contents are unknown.
  • The review is limited to the supplied text evidence and does not verify the safety of executing the PoC.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1