CVE-2026-65601: Namespace Confusion Vulnerability in Traefik Gateway API HTTPRoute BackendRef ExtensionRef Resolution

The Kubernetes Gateway API provides a standardized mechanism for routing traffic into clusters, relying on fine-grained authorization controls to preserve isolation in multi-tenant environments. An integral control is the ReferenceGrant resource, which allows a backend owner in one namespace to authorize routing components (such as an HTTPRoute) from a foreign namespace to bind to their backend Services.

However, in Traefik's Gateway API provider implementation, a critical vulnerability exists when processing custom middleware filters defined under a backend reference (HTTPRoute.spec.rules[].backendRefs[].filters[]). Traefik supports defining custom filters using the ExtensionRef type, which translates to Traefik Custom Resource Definition (CRD) Middleware objects.

When evaluating these backend-level filters, the controller incorrectly binds the resolution context of the filter to the target Service's namespace instead of the source HTTPRoute namespace. This allows unauthorized cross-namespace resource access, exposing highly privileged middlewares (such as those managing authentication, headers injection, or rate-limiting) to unintended tenants.

The root cause of CVE-2026-65601 lies within the file pkg/provider/kubernetes/gateway/httproute.go inside the loadService function. During HTTPRoute compilation, the Traefik Gateway API controller iterates through each rule's backend references to resolve backend Services and associate corresponding filters.

When resolving a cross-namespace reference, the controller evaluates the target namespace defined within the backendRef object. The function temporarily overwrites a local string variable named namespace with the target Service's namespace (backendRef.Namespace). This value is subsequently utilized to perform the Kubernetes API lookup for the corresponding Service object.

Crucially, after resolving the Service, the controller invokes p.loadMiddlewares() to parse and load the associated filters. Because the local namespace variable was mutated to reference the target Service's namespace, the call to loadMiddlewares uses this overwritten value instead of the original HTTPRoute namespace. Consequently, Traefik queries the target namespace for the requested CRD Middleware objects, bypassing the explicit tenant access barriers defined by Gateway API namespaces.

To understand the vulnerability mechanics, examine the difference between the vulnerable and patched code within pkg/provider/kubernetes/gateway/httproute.go under the commit 655d6324ab4a1475892a958d4bae389720a67ea9.

Below is the vulnerable implementation:

// VULNERABLE CODE PATH
// Inside loadService(...)
 
if backendRef.Namespace != nil {
    // The local namespace variable is overwritten here with the backend namespace
    namespace = string(*backendRef.Namespace)
}
 
// ... service resolution logic utilizing the overwritten namespace ...
 
// Bug: The mutated namespace variable is passed to loadMiddlewares
middlewares, err := p.loadMiddlewares(conf, namespace, serviceName, backendRef.Filters, pathMatch)
if err != nil {
    return serviceName, &metav1.Condition{
        Type:               string(gatev1.RouteConditionResolvedRefs),
        // ...
    }
}

In the patched code, the resolution of middlewares is modified to reference the originating route's namespace explicitly:

// PATCHED CODE PATH
// Inside loadService(...)
 
if backendRef.Namespace != nil {
    namespace = string(*backendRef.Namespace)
}
 
// ... service resolution logic utilizing the overwritten namespace ...
 
// Fix: route.Namespace is used instead of the mutated namespace variable
middlewares, err := p.loadMiddlewares(conf, route.Namespace, serviceName, backendRef.Filters, pathMatch)
if err != nil {
    return serviceName, &metav1.Condition{
        Type:               string(gatev1.RouteConditionResolvedRefs),
        // ...
    }
}

This explicit call ensures that even if Traefik queries the destination namespace to bind the destination Service, all filters are retrieved strictly from the security context of the tenant owning the HTTPRoute.

Exploitation of this vulnerability requires that a target namespace contains a privileged Middleware resource and has granted service-level access to the attacker's namespace via a ReferenceGrant. It does not require special administrative privileges.

First, the attacker identifies a legitimate ReferenceGrant that allows their namespace (e.g., default) to send traffic to a target namespace (e.g., production). They target a service inside production called secure-api.

Second, the attacker inspects or guesses the names of existing Middleware CRDs in the production namespace. For example, a target middleware named admin-auth-bypass could inject a trusted custom header like X-Admin-Token: supersecret to the downstream container.

Third, the attacker authors and deploys a malicious HTTPRoute in the default namespace:

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata: 
  name: attack-route
  namespace: default
spec:
  parentRefs:
    - name: public-gateway
  rules:
    - backendRefs:
        - name: secure-api
          namespace: production
          port: 80
          filters:
            - type: ExtensionRef
              extensionRef:
                group: traefik.io
                kind: Middleware
                name: admin-auth-bypass

When Traefik compiles this route, it evaluates secure-api in the production namespace, changes the context namespace to production, and subsequently fetches admin-auth-bypass from production. The attacker successfully mounts a privileged middleware onto their route, gaining unauthorized administrative capabilities.

The impact of CVE-2026-65601 is evaluated based on the compromise of downstream applications and boundary controls. Since Traefik acts as the primary ingress controller and reverse proxy, any failure in routing boundaries translates to direct downstream exploitation.

By hijacking middlewares from foreign namespaces, attackers can bypass critical access controls. This includes executing header manipulation middlewares to spoof authentication payloads, utilizing rate-limiting configurations of other tenants to degrade performance, or redirecting request flows using forward-auth configurations to leak sensitive transaction tokens.

While the direct impact on the Traefik control plane itself is limited (no direct host access or container breakout), the subsequent systems suffer high confidentiality and integrity risks. This matches the CVSS 4.0 assessment where subsequent systems confidentiality (SC) and integrity (SI) are rated as High.

The primary remediation for CVE-2026-65601 is upgrading the Traefik instance to version 3.7.7 or later. The patch permanently separates the target service's namespace from the lookup context of backend-level filters.

If immediate upgrades are impossible, security teams should implement the following containment measures:

1. Restrict ReferenceGrants: Review and eliminate overly permissive ReferenceGrant configurations in the cluster. Ensure that namespaces containing sensitive configurations or middlewares do not allow service-level references from untrusted tenant namespaces.

2. Policy Enforcement: Deploy an admission controller (such as OPA Gatekeeper or Kyverno) to block HTTPRoute definitions in tenant namespaces that utilize ExtensionRef filters inside cross-namespace backendRefs blocks. A Kyverno rule can inspect user submissions and reject any HTTPRoute where backendRefs[].namespace is defined and backendRefs[].filters[].extensionRef is present.