SEPTEMBER 20, 2026
Live Feed
Back to database
Case File

CVE-2026-65601

HIGH · CVSS 8.8 EPSS 0.27% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-22 · Last synced 2026-08-21

CyberRota Analysis

AI-Generated

Traefik versions 3.7.0 through 3.7.6 are vulnerable due to a namespace confusion issue in the Kubernetes Gateway API provider, allowing low-privileged route authors to exploit cross-namespace Service references. This could lead to unauthorized access and the injection of trusted reverse-proxy identity headers into downstream requests. Organizations using affected Traefik versions should prioritize upgrading to version 3.7.7 to mitigate this risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-65601
Severity
HIGH
CVSS
8.8
EPSS
0.27%
Kubernetes

Original NVD Description

Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route author holding a ReferenceGrant for a cross-namespace Service could therefore bind a Traefik Middleware from the backend namespace without a separate grant for that middleware, potentially injecting trusted reverse-proxy identity headers into downstream requests. The issue is fixed in version 3.7.7.

Related CVEs

Other vulnerabilities affecting the same vendor(s)