Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion
Summary
There is a medium-severity namespace-confusion vulnerability in Traefik's Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route author holding a ReferenceGrant for a cross-namespace Service could therefore bind a Traefik Middleware from the backend namespace without a separate grant for that middleware. If the reused middleware sets trusted reverse-proxy identity headers, downstream applications may receive attacker-selected authenticated-identity state. The fix resolves extensionRef against the HTTPRoute namespace.
Patches
- https://github.com/traefik/traefik/releases/tag/v3.7.7
For more information
If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).
<details>
<summary>Original Description</summary>
Summary
Traefik's Kubernetes Gateway API provider resolves
HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef in the backend
Service namespace instead of the HTTPRoute namespace. A low-privileged route
author with a permitted cross-namespace Service reference can therefore bind a
Traefik Middleware from the backend namespace without a separate grant for
that middleware. If the reused middleware sets trusted reverse-proxy identity
headers, downstream applications can receive attacker-selected authenticated
identity state.
Description
Gateway API ReferenceGrant allows a namespace owner to grant a route in
another namespace permission to reference a specific backend object, such as a
Service. That grant should not implicitly authorize the route author to bind
other policy objects in the backend namespace.
In the affected code path, Traefik copies backendRef.namespace into a local
namespace variable. It correctly uses that namespace to validate and load the
backend Service, but then reuses the same namespace when resolving
backendRef.filters[].extensionRef. For Traefik CRD Middleware extension
filters, the CRD provider turns (namespace, name) into a dynamic middleware
reference such as:
```text
platform-privileged-auth-header@kubernetescrd
```
As a result, a tenant route in tenant-a can bind a middleware named
privileged-auth-header from the backend namespace platform, even though the
Gateway API ReferenceGrant only granted access to platform/protected-api
Service.
Impact
The PoC demonstrates that an attacker-authored HTTPRoute can cause Traefik to
attach a backend-namespace Headers middleware to the generated backend
service. The middleware injects:
```text
X-WEBAUTH-USER: admin
```
That is a realistic downstream primitive because many applications support
trusted reverse-proxy authentication headers when deployed behind a gateway.
Separate Docker validation showed this header-auth class can map to
authenticated identities in Grafana, Gitea, Jenkins, SonarQube, and Nexus
Repository when those products are intentionally configured for reverse-proxy
authentication.
This is not a bug in those downstream applications and this PoC does not claim
direct Traefik host RCE, sandbox escape, private-key exfiltration, or default
cluster takeover. The Traefik vulnerability is unauthorized middleware binding
across a Gateway API namespace boundary.
Proof Of Concept
Files
<details>
<summary>run.sh</summary>
```bash
#!/usr/bin/env sh
set -eu
TARGET_REF="${TARGET_REF:-v3.7.5}"
REPO_URL="${REPO_URL:-https://github.com/traefik/traefik.git}"
SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
WORKDIR="${WORKDIR:-$(mktemp -d "${TMPDIR:-/tmp}/traefik-gw-extref-poc.XXXXXX")}"
if [ "${KEEP_WORKDIR:-0}" != "1" ]; then
trap 'rm -rf "$WORKDIR"' EXIT INT TERM
fi
printf '[*] target_ref=%s\n' "$TARGET_REF"
printf '[*] workdir=%s\n' "$WORKDIR"
if [ -n "${TRAEFIK_SRC:-}" ]; then
printf '[*] cloning from local source: %s\n' "$TRAEFIK_SRC"
git clone -q "$TRAEFIK_SRC" "$WORKDIR/traefik"
cd "$WORKDIR/traefik"
git -c advice.detachedHead=false checkout -q "$TARGET_REF"
else
printf '[*] cloning from remote: %s\n' "$REPO_URL"
git -c advice.detachedHead=false clone -q --depth 1 --branch "$TARGET_REF" "$REPO_URL" "$WORKDIR/traefik"
cd "$WORKDIR/traefik"
fi
mkdir -p pkg/provider/kubernetes/gateway/fixtures/httproute
cp "$SCRIPT_DIR/poc_gateway_extensionref_test.go" \
pkg/provider/kubernetes/gateway/httproute_backend_filter_namespace_poc_test.go
cp "$SCRIPT_DIR/backendref_extension_filter_cross_namespace_poc.yml" \
pkg/provider/kubernetes/gateway/fixtures/httproute/backendref_extension_filter_cross_namespace_poc.yml
if grep -Fq 'loadConfigurationFromGateways(ctx context.Context) (*dynamic.Configuration, *statusReport, error)' pkg/provider/kubernetes/gateway/kubernetes.go; then
sed -i \
-e 's/conf := p\.loadConfigurationF
