CVE-2026-54765 Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port
Attackers can leak security-sensitive headers across routes sharing a backend, bypassing authorization contexts in Traefik Gateway API deployments.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54765?
CVE-2026-54765 is a medium-severity missing authorization vulnerability in Traefik Traefik, published on 6 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Traefik is an open source HTTP reverse proxy and load balancer. From v3.7.0 prior to v3.7.6, Traefik's Kubernetes Gateway API provider may resolve two accepted HTTPRoutes that target the same backend Service:port but configure different backendRef filters to the same child service and apply only one route's filter set to all requests reaching that backend. In Gateway deployments where backendRef filters set security-sensitive headers, such as tenant identity, authorization context, or values the backend trusts, an attacker who can create an accepted HTTPRoute sharing the same backend Service:port may cause their route's filter context to be applied to another route's requests, potentially crossing namespace boundaries when a ReferenceGrant permits cross-namespace targeting. This issue is fixed in version v3.7.6.
Which versions are affected by CVE-2026-54765?
5 open source packages ship an affected version, including github.com/traefik/traefik/v3, github.com/traefik/traefik and github.com/traefik/traefik/v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/traefik/traefik/v3 Go | From 3.7.0 | 3.7.6 |
github.com/traefik/traefik/v3 Go | From 3.7.0 | 3.7.6 |
github.com/traefik/traefik/v3 Go | From 3.7.0 | 3.7.6 |
github.com/traefik/traefik Go | All versions | None |
github.com/traefik/traefik/v2 Go | All versions | None |
Products include Traefik Traefik.
How do I fix CVE-2026-54765?
Upgrade github.com/traefik/traefik/v3 to 3.7.6 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-54765 being exploited?
There is no known exploitation of CVE-2026-54765 in the wild and no public exploit code.
Other vulnerabilities in Traefik Traefik
- CVE-2024-45410 HTTP client can remove the X-Forwarded headers in Traefik
- CVE-2026-88877 Traefik v3.7.0 Authentication Bypass via from-to-www-redirect
- CVE-2026-85595 Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth
- CVE-2026-88007 Traefik HTTP/3 Backend NTLM Connection Reuse
- CVE-2026-88009 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
Sources
Also known as GHSA-6p8f-p8j2-rqmv, GO-2026-6205, MINI-27mj-qjgr-6ph2, MINI-g6g7-5vxv-5m6p, MINI-wccq-r38p-hj92.