Gooood4U

**Name of the Vulnerable Software and Affected Versions** Traefik versions 3.7.0 through 3.7.5 **Description** Traefik's Kubernetes Gateway API provider may incorrectly resolve two accepted HTTPRoutes that target the same backend Service:port but use different `backendRef` filters for the same child service. This results in only one route's filter set being applied to all requests reaching that backend. In deployments where `backendRef` filters manage security-sensitive headers—such as tenant identity or authorization context—an attacker capable of creating an accepted HTTPRoute sharing the same backend Service:port could cause their filter context to be applied to requests from another route. This may lead to namespace boundary crossings when a ReferenceGrant allows cross-namespace targeting. **Recommendations** Update to version 3.7.6.