GHSA-qq9q-x9w4-chhj Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion
SummaryThere is a medium-severity namespace-confusion vulnerability in Traefik's Kubernetes Gateway API provider. When resolving `HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef`, Traefik used the backend Service namespace instead of the `HTTPRoute` namespace. A low-privileged route author holding a `ReferenceGrant` for a cross-namespace Service could therefore bind a Traefik `Middleware` from the backend namespace without a separate grant for that middleware. If the reused middleware sets trusted reverse-proxy identity headers, downstream applications may receive attacker-selected authenticated-identity state. The fix resolves `extensionRef` against the `HTTPRoute` namespace.Patcheshttps://github.com/traefik/traefik/releases/tag/v3.7.7For more informationIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).SummaryTraefik's Kubernetes Gateway API provider resolves
`HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef` in the backend
Service namespace instead of the `HTTPRoute` namespace. A low-privileged route
author with a permitted cross-namespace Service reference can therefore bind a
Traefik `Middleware` from the backend namespace without a separate grant for
that middleware. If the reused middleware sets trusted reverse-proxy identity
headers, downstream applications can receive attacker-selected authenticated
identity state.DescriptionGateway API `ReferenceGrant` allows a namespace owner to grant a route in
another namespace permission to reference a specific backend object, such as a
`Service`. That grant should not implicitly authorize the route author to bind
other policy objects in the backend namespace.In the affected code path, Traefik copies `backendRef.namespace` into a local
`namespace` variable. It correctly uses that namespace to validate and load the
backend `Service`, but then reuses the same namespace when resolving
`backendRef.filters[].extensionRef`. For Traefik CRD `Middleware` extension
filters, the CRD provider turns `(namespace, name)` into a dynamic middleware
reference such as:As a result, a tenant route in `tenant-a` can bind a middleware named
`privileged-auth-header` from the backend namespace `platform`, even though the
Gateway API `ReferenceGrant` only granted access to `platform/protected-api`
`Service`.ImpactThe PoC demonstrates that an attacker-authored `HTTPRoute` can cause Traefik to
attach a backend-namespace `Headers` middleware to the generated backend
service. The middleware injects:That is a realistic downstream primitive because many applications support
trusted reverse-proxy authentication headers when deployed behind a gateway.
Separate Docker validation showed this header-auth class can map to
authenticated identities in Grafana, Gitea, Jenkins, SonarQube, and Nexus
Repository when those products are intentionally configured for reverse-proxy
authentication.This is not a bug in those downstream applications and this PoC does not claim
direct Traefik host RCE, sandbox escape, private-key exfiltration, or default
cluster takeover. The Traefik vulnerability is unauthorized middleware binding
across a Gateway API namespace boundary.Proof Of ConceptFilesRequirements`git`Go toolchain compatible with the target Traefik tag. `v3.7.5` uses
`go 1.25.0`.Network access to clone `https://github.com/traefik/traefik.git` and download
Go modules on first run.No local Traefik checkout or Kubernetes cluster is required by default.RunOptional target override:Optional local-source override for faster validation:Expected ResultThe run should end with:Root CauseLine numbers below are from:1. Route-level filters use the route namespace`pkg/provider/kubernetes/gateway/httproute.go:143-144`For filters directly on `HTTPRoute.rules[]`, Traefik resolves extension filters
relative to `route.Namespace`. This matches the Gateway API
`LocalObjectReference` model.2. BackendRef namespace overwrites the route namespace`pkg/provider/kubernetes/gateway/httproute.go:240-243`For a cross-namespace backend Service, `namespace` becomes the backend
namespace, for example `platform`.3. ReferenceGrant checks only the backend object`pkg/provider/kubernetes/gateway/httproute.go:258-266`This validates permission to reference the backend object, such as
`platform/protected-api` `Service`.4. The backend namespace is reused for backendRef filters`pkg/provider/kubernetes/gateway/httproute.go:269-277`The same `namespace` variable now points to the backend namespace. Therefore an
`ExtensionRef` inside `backendRef.filters[]` is resolved as
`platform/<middleware-name>` instead of `tenant-a/<middleware-name>`.5. CRD Middleware extension refs are qualified by the namespace supplied by Gateway provider`pkg/provider/kubernetes/crd/kubernetes.go:169-175`The namespace passed from `loadMiddlewares()` decides which CRD `Middleware`
object becomes part of the dynamic service configuration.6. Service-level middlewares are applied at runtime`pkg/server/service/service.go:186-194`The unauthorized middleware reference is not merely stored. Traefik applies
service-level middlewares to the backend load balancer handler during normal
HTTP service construction.Minimal Exploit ShapeThe PoC fixture contains the essential object graph:In a real affected deployment, if `platform/privileged-auth-header` sets a
trusted identity header, requests sent through the tenant route can reach the
backend with that header injected by Traefik.WorkaroundsAvoid granting untrusted namespaces permission to attach `HTTPRoute` objects
to shared Gateways that route to sensitive backends.Do not place privileged or identity-bearing Traefik `Middleware` objects in
namespaces that can be reached by untrusted cross-namespace `HTTPRoute`
backend references.Prefer route-local filters and explicitly audit
`HTTPRoute.rules[].backendRefs[].filters[].extensionRef` usage.Strip trusted reverse-proxy identity headers at backend application
boundaries unless they originate from a dedicated authentication gateway.Scope BoundaryExploitation requires low-privileged route-author capability in a Kubernetes
Gateway API deployment. A remote unauthenticated web client without
`HTTPRoute` authoring capability cannot create the malicious route. If the
shared Gateway is internet-facing, the final request that triggers the
unauthorized middleware can be sent over the public network after the route is
created.
CVSS v4.0 score: 5.3