CVE-2026-54761

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 3.6.21 Traefik versions prior to 3.7.5

Description An issue exists in the Kubernetes Gateway provider regarding the crossProviderNamespaces allowlist. When HTTPRoute rules declare multiple backendRefs (Weighted Round Robin), the system evaluates the allowlist against the target backendRef.namespace instead of the namespace of the route itself. This allows an HTTPRoute created in a non-allow-listed namespace to reference internal cross-provider TraefikService components, such as api@internal, dashboard@internal, or rest@internal, by pointing the backendRef.namespace to an allow-listed namespace that has a matching Gateway API ReferenceGrant. This results in the exposure of internal Traefik services on the data plane. Exploitation requires the ability to create an accepted HTTPRoute and a corresponding ReferenceGrant from an allow-listed namespace.

Recommendations Update to version 3.6.21. Update to version 3.7.5.