CVE-2026-54765

[CVE catalog]

Severity

High · CVSS 8.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

Published

Jul 6, 2026, 8:27:32 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.35% · Oct 25, 2026

A flaw was found in Traefik's Kubernetes Gateway API provider. An attacker capable of creating an accepted HTTPRoute that shares the same backend Service and port could exploit this vulnerability. The system may incorrectly apply the attacker's route filter context to another route's requests, potentially allowing unauthorized access or information disclosure across different namespaces. This could lead to the application of security-sensitive headers from the attacker's route to legitimate requests, bypassing intended security controls. traefik: Traefik: Unauthorized filter context application in Kubernetes Gateway API provider This Moderate flaw in Traefik's Kubernetes Gateway API provider, as deployed in Red Hat OpenShift Dev Spaces, could allow an attacker to apply their route's filter context to other requests. This can lead to unauthorized access or information disclosure across namespace boundaries when `backendRef` filters are used for security-sensitive headers, as it allows bypassing intended security controls. Exploitation requires the attacker to create an accepted HTTPRoute. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.