Traefik Gateway API provider: extensionRef resolved in the wrong namespace, letting a route bind an ungranted Middleware

Impact

Traefik resolved HTTPRoute filter extensionRefs against the backend Service's namespace instead of the HTTPRoute's own namespace. A tenant who holds a ReferenceGrant for a cross-namespace Service therefore inherits the ability to attach any Traefik Middleware living in that backend namespace, with no separate grant for the middleware - the ReferenceGrant boundary that multi-tenant Gateway API setups rely on simply does not hold for this field. The practical abuse named in the advisory is injecting trusted reverse-proxy identity headers into downstream requests, which is how a tenant impersonates an authenticated principal to a backend that trusts the proxy. The CVSS vector scores subsequent-system confidentiality and integrity as high, which is the right read: the damage lands on the backend services behind the ingress, not on Traefik. In a shared GPU cluster where tenants file their own HTTPRoutes and inference endpoints sit behind the same ingress, that is a cross-tenant authentication bypass against the serving layer.

Who can reach it

Network, authenticated with low privilege in the cluster: a tenant who can create or edit an HTTPRoute in their own namespace and already holds a ReferenceGrant to a Service in another namespace. No cluster-admin rights, and no access to the backend namespace itself.

What to do

Upgrade Traefik to 3.7.7 (affects 3.7.0 through 3.7.6) and restart the Traefik pods - a rolling restart of the ingress deployment, no node drain. If you cannot upgrade immediately, audit HTTPRoutes in tenant namespaces whose backendRefs cross namespaces and whose filters carry an extensionRef, and remove the cross-namespace ReferenceGrants until patched. Verify downstream services are not treating proxy-set identity headers as trustworthy without their own check.

References

Related entries

• Traefik: IngressRouteTCP ignores crossProviderNamespaces, letting any namespace borrow file-provider mTLS identityCVE-2026-65602 · Traefik (IngressRouteTCP serversTransport cross-provider allowlist)Medium
• JFrog Artifactory: authenticated write outside the Docker repository cache pathCVE-2026-66384 · JFrog Artifactory (Docker remote repository cache path)Medium
• Envoy: semicolon path parameters make routing pick an unprotected route for a protected resourceCVE-2026-73511 · Envoy HTTP path matching (ignore_path_parameters_in_path_matching, semicolon matrix parameters)Medium
• Envoy: scoped IPv6 address reconstruction aborts the proxy process in ORIGINAL_DST and QUIC pathsCVE-2026-73549 · Envoy Utility::copyInternetAddressAndPort and QUIC client-address handling (scoped IPv6 addresses)Medium
• Envoy: path normalization misses ..;param segments, bypassing path-based routing and RBACCVE-2026-73551 · Envoy (URL path normalization, dot segments with semicolon parameters)Medium
• Rancher Fleet: Helm template preprocessing reaches the network, leaking cluster metadata via DNSCVE-2026-75036 · Rancher Fleet controller (Helm template preprocessing / GitRepo bundle content)Medium