CVE-2026-54761

MEDIUM

Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-54761 has a selected CVSS score of 6.0 (medium); EIP currently links 1 repository PoC.

Description

Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.21 and 3.7.5, there is a high severity vulnerability in Traefik's Kubernetes Gateway provider affecting the crossProviderNamespaces allowlist. For HTTPRoute rules that declare multiple (WRR) backendRefs, Traefik evaluates the allowlist against the target backendRef.namespace instead of the route's own namespace. As a result, an HTTPRoute created in a namespace that is not allow-listed can reference a cross-provider TraefikService such as api@internal, dashboard@internal or rest@internal by pointing backendRef.namespace at an allow-listed namespace covered by a Gateway API ReferenceGrant, exposing internal Traefik services on the data plane. Exploitation requires the ability to create an accepted HTTPRoute and a matching ReferenceGrant from an allow-listed namespace; it does not require any change to Traefik static configuration, RBAC, or the deployment itself. This vulnerability is fixed in 3.6.21 and 3.7.5.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 25, 2026 · Source: CVE List

Affected products and versions

4
ProductSourceVersion range

traefik

Browse traefik / traefik
CVE List< 3.6.21affected
>= 3.7.0-ea.1, < 3.7.5affected

github.com/traefik/traefik

Browse Go / github.com/traefik/traefik
GitHub AdvisoryThrough 1.7.34affected

github.com/traefik/traefik/v2

Browse Go / github.com/traefik/traefik/v2
GitHub AdvisoryThrough 2.11.50affected

github.com/traefik/traefik/v3

Browse Go / github.com/traefik/traefik/v3
GitHub AdvisoryBefore 3.6.21 · Fixed in 3.6.21affected
3.7.0-ea.1 to < 3.7.5 · Fixed in 3.7.5affected

Proofs of concept

1

Repository PoCs

GitHubSaku0512/CVE-2026-54761-pocRepository PoCby Saku05120Exploit6 files

19.4 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Proof of Concept (PoC) exploit for CVE-2026-54761. It provides a script and Kubernetes manifests to create a local kind cluster running a vulnerable version of Traefik (v3.7.1) and demonstrates a crossProviderNamespaces bypass. The exploit route uses multiple weighted backendRefs to expose the internal api@internal service from an unauthorized namespace, while a control route with a single backendRef is correctly blocked.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of documentation and a Kubernetes manifest for a CVE-2026-54761 proof-of-concept. The README files describe the vulnerability and how to run the PoC in a local kind cluster. The gateway-exploit.yaml manifest defines namespaces, a deployment, a service, a ReferenceGrant, a Gateway, and two HTTPRoutes that demonstrate the authorization bypass. No backdoor, deceptive payload, or concealed operator-directed harm is present in the reviewed text. The artifact is a straightforward educational PoC that exploits the described CVE against a local Traefik instance.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesShellYAMLMarkdown
Target softwareTraefik
Attack typesAuthorization BypassInformation Disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is classified as an exploit because it includes a complete, executable script and Kubernetes manifests designed to actively exercise the vulnerability by deploying a vulnerable Traefik instance and triggering the bypass to expose an internal service. The README explicitly describes it as a 'Proof of Concept' that demonstrates the vulnerability in an isolated environment.

README.en.md:6README.en.md:60-69README.en.md:100-108

Requirements

  • Ability to create an HTTPRoute in an unauthorized namespace and a matching ReferenceGrant in an authorized namespace.README.en.md:8
  • Traefik Kubernetes Gateway provider configured with a crossProviderNamespaces allowlist.README.en.md:66

Observed behavior

  • Creates a local kind cluster with Traefik v3.7.1 and Gateway API CRDs.README.en.md:62-66
  • Deploys a control HTTPRoute with a single backendRef to api@internal from the 'attacker' namespace, which is expected to return a 404 error.README.en.md:94-98
  • Deploys an exploit HTTPRoute with multiple weighted backendRefs, including api@internal, from the 'attacker' namespace, which successfully exposes the Traefik API.README.en.md:100-108
  • The exploit route's backendRefs include a TraefikService pointing to api@internal in the 'trusted' namespace and a regular Service in the 'attacker' namespace.external-repro-kind/gateway-exploit.yaml:116-127
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Cve Reference
CVE-2026-54761The artifact is a PoC for this specific Traefik vulnerability, as stated in the README files.README.en.md:6
Execution Instruction
cd external-repro-kind && ./run-kind-repro.shThe README instructs the user to run a shell script to reproduce the vulnerability in a local kind cluster. The script itself is not included in the reviewed evidence.README.en.md:80-82
Kubernetes Manifest
external-repro-kind/gateway-exploit.yamlThis manifest creates the resources needed to demonstrate the CVE, including an HTTPRoute that bypasses the crossProviderNamespaces allowlist.external-repro-kind/gateway-exploit.yaml:1-127
Review boundaries

What the analysis did not establish

  • The evidence packet does not include the content of the shell script 'run-kind-repro.sh' or the YAML files 'kind-config.yaml' and 'traefik-v371.yaml', which are necessary for the full end-to-end reproduction. Only the README files and the 'gateway-exploit.yaml' manifest are provided.
  • The run-kind-repro.sh script and other YAML files (kind-config.yaml, traefik-v371.yaml) are not included in the reviewed text. Their contents are unknown and could contain backdoor behavior not visible in the supplied evidence.
  • Binary files are reported as present but not analyzed; their contents are unknown.
  • The review is limited to the supplied text evidence and does not verify the safety of executing the PoC.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

5