GHSA-6P8F-P8J2-RQMV中危已审查

Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port

OSV 1.4.0 · github-reviewed · 修改于 2026-08-07 00:40

发布时间

2026-08-07 00:40

GitHub 审查时间

2026-08-07 00:40

NVD 发布时间

2026-07-07 05:16

源文件

advisories/github-reviewed/2026/08/GHSA-6p8f-p8j2-rqmv/GHSA-6p8f-p8j2-rqmv.json

公告说明

Summary

There is a medium severity vulnerability in Traefik's Kubernetes Gateway API provider. When two accepted HTTPRoutes target the same backend Service:port but configure different backendRef filters, Traefik may resolve both routes to the same child service and apply only one route's filter set to all requests reaching that backend. In Gateway deployments where backendRef filters set security-sensitive headers — such as tenant identity, authorization context, or values the backend trusts — an attacker who can create an accepted HTTPRoute sharing the same backend Service:port may cause their route's filter context to be applied to another route's requests, potentially crossing namespace boundaries when a ReferenceGrant permits cross-namespace targeting.

Patches

https://github.com/traefik/traefik/releases/tag/v3.7.6

For more information

If you have any questions or comments about this advisory, please open an issue.

<details> <summary>Original Description</summary>

Traefik Gateway HTTPRoute backendRef filter context collision across routes sharing Service:port

Summary

Traefik's Kubernetes Gateway API provider builds the dynamic HTTP backend service key for a Gateway HTTPRoute backendRef from only the backend namespace, Service name, protocol, and port. It does not include the HTTPRoute, listener, rule, or backendRef filter identity in that key.

When two accepted HTTPRoutes point to the same backend Service:port but define different backendRef filters, Traefik can make both route WRR services reference the same child service. The child service then carries only one backendRef filter set, so one route can send requests to the backend with another route's backend context.

This is security-relevant when backendRef filters set, remove, or rewrite security-sensitive context, such as tenant, identity, auth, sanitization, Host, or path headers trusted by the backend.

Credit: Qican Ma, Ding Luo @XiaoMi ShadowBlade Security Lab

Suggested Severity

Suggested severity: Medium/High, configuration-dependent.

</details>

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N

Requires Gateway API routes sharing the same backend Service:port with different security-sensitive backendRef filters trusted by the backend.
Cross-namespace impact is possible when route attachment and ReferenceGrant policy allow an attacker route to target the shared backend.
No RCE, memory corruption, or default-config exposure claimed.

CWE-863: Incorrect Authorization
CWE-284: Improper Access Control

pkg/provider/kubernetes/gateway/httproute.go — loadService(), loadMiddlewares()

Traefik source snapshot: 29406d42898547f1ffabd904f66af06c212740cf on master

Earliest affected version not exhaustively determined.

loadService starts the dynamic service name from backend namespace and Service name only:

// pkg/provider/kubernetes/gateway/httproute.go:245
serviceName := provider.Normalize(namespace + "-" + string(backendRef.Name) + "-http")

It loads backendRef filters using that same service name before appending the backend port:

// pkg/provider/kubernetes/gateway/httproute.go:258
middlewares, err := p.loadMiddlewares(conf, namespace, serviceName, backendRef.Filters, pathMatch)

For normal Kubernetes Services, the final child service key appends only the port:

// pkg/provider/kubernetes/gateway/httproute.go:304-317
portStr := strconv.FormatInt(int64(port), 10)
serviceName = provider.Normalize(serviceName + "-" + portStr)
...
conf.HTTP.Services[serviceName] = &dynamic.Service{LoadBalancer: lb, Middlewares: middlewares}

Each route/rule WRR service references the child service by name. Later route configs are merged by map key (maps.Copy), so both route-local WRR services can point to the same child service, which retains only one of the route/backendRef filter configurations.

Gateway listener with allowedRoutes.namespaces.from: All.
Victim HTTPRoute route-a in namespace default targets default/whoami:80 with backendRef filter setting X-Tenant: tenant-a.
Attacker-controlled HTTPRoute route-b in namespace attacker targets default/whoami:80 (via ReferenceGrant) with backendRef filter setting X-Tenant: tenant-b.
Both routes generate the same child service key: default-whoami-http-80.
The second route's filter configuration overwrites the first (or vice versa) via maps.Copy.
Backend receives both routes' requests with one tenant's header context.

A Go test harness injects provider-level and server-level tests into the Traefik checkout. The provider test confirms the generated dynamic configuration collision. The server test builds Traefik's runtime router/service/middleware pipeline and sends httptest requests through router matching, WRR service dispatch, service-level backendRef middleware, and backend proxy capture.

{
  "name": "positive_cross_namespace_same_backend_filter_collision",
  "pass": true,
  "expected": {"route-a": "tenant-a", "route-b": "tenant-b"},
  "observed": {"route-a": "tenant-a", "route-b": "tenant-a"},
  "runtimeObserved": {"route-a": "tenant-a", "route-b": "tenant-a"},
  "childServices": {"route-a": "default-whoami-http-80", "route-b": "default-whoami-http-80"}
}

Negative controls confirmed:

Separate backend Service:port keys produce correct per-route filter isolation.
Identical filters across routes produce no security-relevant difference.

The PoC files can be shared upon request.

An actor who can create or modify an accepted HTTPRoute can cause another accepted route that targets the same backend Service:port to use the wrong backendRef filter context. In cross-namespace Gateway deployments, this can cross namespace boundaries.

High-value impact: gateway-injected tenant, identity, auth, role, header sanitization, Host rewrite, or path rewrite context is trusted by the backend. Lower-value impact: the overwritten header is informational or observability-only.

Suggested Remediation

Include route/listener/rule/backendRef filter identity in the generated child service name when backendRef filters are present.
Split the load-balancer service from the backendRef filter application so per-route backend filters remain route-scoped.
Detect conflicting backendRef filters for the same generated service key and reject or disambiguate the configuration.

2026-06-04: Discovered and reproduced with local test harness.

受影响的软件包

github.com/traefik/traefik/v3

ECOSYSTEM

引入3.7.0修复3.7.6

标识信息

别名 / CVE

CVE-2026-54765

CWE

CWE-284CWE-863

软件生态

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V4

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N

原始 OSV JSON

{
  "id": "GHSA-6p8f-p8j2-rqmv",
  "aliases": [
    "CVE-2026-54765"
  ],
  "details": "## Summary\n\nThere is a medium severity vulnerability in Traefik's Kubernetes Gateway API provider.\nWhen two accepted HTTPRoutes target the same backend Service:port but configure different\n`backendRef` filters, Traefik may resolve both routes to the same child service and apply\nonly one route's filter set to all requests reaching that backend. In Gateway deployments\nwhere `backendRef` filters set security-sensitive headers — such as tenant identity,\nauthorization context, or values the backend trusts — an attacker who can create an\naccepted HTTPRoute sharing the same backend Service:port may cause their route's filter\ncontext to be applied to another route's requests, potentially crossing namespace\nboundaries when a `ReferenceGrant` permits cross-namespace targeting.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v3.7.6\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n<details>\n<summary>Original Description</summary>\n\n# Traefik Gateway HTTPRoute backendRef filter context collision across routes sharing Service:port\n\n## Summary\n\nTraefik's Kubernetes Gateway API provider builds the dynamic HTTP backend service key for a Gateway `HTTPRoute` backendRef from only the backend namespace, Service name, protocol, and port. It does not include the HTTPRoute, listener, rule, or backendRef filter identity in that key.\n\nWhen two accepted HTTPRoutes point to the same backend `Service:port` but define different backendRef filters, Traefik can make both route WRR services reference the same child service. The child service then carries only one backendRef filter set, so one route can send requests to the backend with another route's backend context.\n\nThis is security-relevant when backendRef filters set, remove, or rewrite security-sensitive context, such as tenant, identity, auth, sanitization, Host, or path headers trusted by the backend.\n\nCredit: Qican Ma, Ding Luo @XiaoMi ShadowBlade Security Lab\n\n## Suggested Severity\n\nSuggested severity: Medium/High, configuration-dependent.\n\nSuggested CVSS 3.1:\n\n```text\nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N\n```\n\nNotes:\n\n- Requires Gateway API routes sharing the same backend Service:port with different security-sensitive backendRef filters trusted by the backend.\n- Cross-namespace impact is possible when route attachment and ReferenceGrant policy allow an attacker route to target the shared backend.\n- No RCE, memory corruption, or default-config exposure claimed.\n\nSuggested CWE:\n\n```text\nCWE-863: Incorrect Authorization\nCWE-284: Improper Access Control\n```\n\n## Affected Component\n\n```text\npkg/provider/kubernetes/gateway/httproute.go — loadService(), loadMiddlewares()\n```\n\n## Tested Versions\n\nConfirmed on:\n\n```text\nTraefik source snapshot: 29406d42898547f1ffabd904f66af06c212740cf on master\n```\n\nEarliest affected version not exhaustively determined.\n\n## Root Cause\n\n`loadService` starts the dynamic service name from backend namespace and Service name only:\n\n```go\n// pkg/provider/kubernetes/gateway/httproute.go:245\nserviceName := provider.Normalize(namespace + \"-\" + string(backendRef.Name) + \"-http\")\n```\n\nIt loads backendRef filters using that same service name before appending the backend port:\n\n```go\n// pkg/provider/kubernetes/gateway/httproute.go:258\nmiddlewares, err := p.loadMiddlewares(conf, namespace, serviceName, backendRef.Filters, pathMatch)\n```\n\nFor normal Kubernetes Services, the final child service key appends only the port:\n\n```go\n// pkg/provider/kubernetes/gateway/httproute.go:304-317\nportStr := strconv.FormatInt(int64(port), 10)\nserviceName = provider.Normalize(serviceName + \"-\" + portStr)\n...\nconf.HTTP.Services[serviceName] = &dynamic.Service{LoadBalancer: lb, Middlewares: middlewares}\n```\n\nEach route/rule WRR service references the child service by name. Later route configs are merged by map key (`maps.Copy`), so both route-local WRR services can point to the same child service, which retains only one of the route/backendRef filter configurations.\n\n## Attack Scenario\n\n1. Gateway listener with `allowedRoutes.namespaces.from: All`.\n2. Victim `HTTPRoute` `route-a` in namespace `default` targets `default/whoami:80` with backendRef filter setting `X-Tenant: tenant-a`.\n3. Attacker-controlled `HTTPRoute` `route-b` in namespace `attacker` targets `default/whoami:80` (via ReferenceGrant) with backendRef filter setting `X-Tenant: tenant-b`.\n4. Both routes generate the same child service key: `default-whoami-http-80`.\n5. The second route's filter configuration overwrites the first (or vice versa) via `maps.Copy`.\n6. Backend receives both routes' requests with one tenant's header context.\n\n## Proof of Concept\n\nA Go test harness injects provider-level and server-level tests into the Traefik checkout. The provider test confirms the generated dynamic configuration collision. The server test builds Traefik's runtime router/service/middleware pipeline and sends `httptest` requests through router matching, WRR service dispatch, service-level backendRef middleware, and backend proxy capture.\n\nObserved result:\n\n```json\n{\n  \"name\": \"positive_cross_namespace_same_backend_filter_collision\",\n  \"pass\": true,\n  \"expected\": {\"route-a\": \"tenant-a\", \"route-b\": \"tenant-b\"},\n  \"observed\": {\"route-a\": \"tenant-a\", \"route-b\": \"tenant-a\"},\n  \"runtimeObserved\": {\"route-a\": \"tenant-a\", \"route-b\": \"tenant-a\"},\n  \"childServices\": {\"route-a\": \"default-whoami-http-80\", \"route-b\": \"default-whoami-http-80\"}\n}\n```\n\nNegative controls confirmed:\n\n- Separate backend Service:port keys produce correct per-route filter isolation.\n- Identical filters across routes produce no security-relevant difference.\n\nThe PoC files can be shared upon request.\n\n## Impact\n\nAn actor who can create or modify an accepted HTTPRoute can cause another accepted route that targets the same backend Service:port to use the wrong backendRef filter context. In cross-namespace Gateway deployments, this can cross namespace boundaries.\n\nHigh-value impact: gateway-injected tenant, identity, auth, role, header sanitization, Host rewrite, or path rewrite context is trusted by the backend.\nLower-value impact: the overwritten header is informational or observability-only.\n\n## Suggested Remediation\n\n1. Include route/listener/rule/backendRef filter identity in the generated child service name when backendRef filters are present.\n2. Split the load-balancer service from the backendRef filter application so per-route backend filters remain route-scoped.\n3. Detect conflicting backendRef filters for the same generated service key and reject or disambiguate the configuration.\n\n## Timeline\n\n```text\n2026-06-04: Discovered and reproduced with local test harness.\n```\n\n</details>\n\n---",
  "summary": "Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "3.7.0"
            },
            {
              "fixed": "3.7.6"
            }
          ]
        }
      ],
      "package": {
        "name": "github.com/traefik/traefik/v3",
        "ecosystem": "Go"
      },
      "database_specific": {
        "last_known_affected_version_range": "<= 3.7.5"
      }
    }
  ],
  "modified": "2026-08-06T16:40:31Z",
  "severity": [
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N"
    }
  ],
  "published": "2026-08-06T16:40:31Z",
  "references": [
    {
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-6p8f-p8j2-rqmv",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54765",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/traefik/traefik/pull/13367",
      "type": "WEB"
    },
    {
      "url": "https://github.com/traefik/traefik/commit/8aada7a7d52e4588a75386d8b86d270f6fe8d549",
      "type": "WEB"
    },
    {
      "url": "https://github.com/traefik/traefik",
      "type": "PACKAGE"
    },
    {
      "url": "https://github.com/traefik/traefik/releases/tag/v3.7.6",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-863"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": "2026-07-06T21:16:57Z",
    "github_reviewed_at": "2026-08-06T16:40:31Z"
  }
}