CyberRota Analysis
AI-GeneratedTraefik versions 3.7.0 through 3.7.6 are vulnerable due to a namespace confusion issue in the Kubernetes Gateway API provider, allowing low-privileged route authors to exploit cross-namespace Service references. This could lead to unauthorized access and the injection of trusted reverse-proxy identity headers into downstream requests. Organizations using affected Traefik versions should prioritize upgrading to version 3.7.7 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route author holding a ReferenceGrant for a cross-namespace Service could therefore bind a Traefik Middleware from the backend namespace without a separate grant for that middleware, potentially injecting trusted reverse-proxy identity headers into downstream requests. The issue is fixed in version 3.7.7.
Related CVEs
Other vulnerabilities affecting the same vendor(s)