CVE-2026-54761

[CVE catalog]

Severity

High · CVSS 7.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Published

Jun 23, 2026, 7:15:38 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.37% · Oct 25, 2026

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. This vulnerability exists in the Kubernetes Gateway provider's `crossProviderNamespaces` allowlist. A remote attacker with the ability to create an accepted HTTPRoute and a matching ReferenceGrant can exploit this by misconfiguring the `backendRef.namespace` to bypass the allowlist. This allows the attacker to expose internal Traefik services, such as the API or dashboard, on the data plane, leading to information disclosure. traefik: Traefik: Internal service exposure due to crossProviderNamespaces allowlist misconfiguration Red Hat OpenShift Dev Spaces ships a version of traefik affected by this vulnerability. The flaw allows a user with Kubernetes RBAC permissions to create HTTPRoute resources to bypass the crossProviderNamespaces allowlist and access internal Traefik services such as api@internal. No upstream fix is available for the shipped v2 line; fixes exist only in v3.6.21+ and v3.7.5+. Exploitation requires specific Kubernetes Gateway API configuration with crossProviderNamespaces and existing ReferenceGrant permissions. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.