CVE-2026-65601 Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef
Traefik allows low-privileged users to inject headers by bypassing namespace checks in Kubernetes Gateway API configurations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-65601?
CVE-2026-65601 is a medium-severity missing authorization vulnerability in Traefik Traefik, published on 22 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route author holding a ReferenceGrant for a cross-namespace Service could therefore bind a Traefik Middleware from the backend namespace without a separate grant for that middleware, potentially injecting trusted reverse-proxy identity headers into downstream requests. The issue is fixed in version 3.7.7.
Weakness: CWE-863
Which versions are affected by CVE-2026-65601?
3 open source packages ship an affected version, including Traefik and github.com/traefik/traefik. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
Traefik Go | From 3.7.0 | 3.7.7 |
Traefik Go | From 3.7.0 | 3.7.7 |
github.com/traefik/traefik Go | All versions | None |
Products include Traefik Traefik.
How do I fix CVE-2026-65601?
Upgrade Traefik to 3.7.7 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-65601 being exploited?
There is no known exploitation of CVE-2026-65601 in the wild and no public exploit code.
Other vulnerabilities in Traefik Traefik
- CVE-2024-45410 HTTP client can remove the X-Forwarded headers in Traefik
- CVE-2026-88877 Traefik v3.7.0 Authentication Bypass via from-to-www-redirect
- CVE-2026-85595 Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth
- CVE-2026-88007 Traefik HTTP/3 Backend NTLM Connection Reuse
- CVE-2026-88009 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
Sources
Also known as GHSA-qq9q-x9w4-chhj, GO-2026-6198, MINI-8w5m-65pq-3vfw, MINI-chpq-j4gc-rh8x.