CVE-2026-54765

Traefik is an open source HTTP reverse proxy and load balancer. From v3.7.0 prior to v3.7.6, Traefik's Kubernetes Gateway API provider may resolve two accepted HTTPRoutes that target the same backend Service:port but configure different backendRef filters to the same child service and apply only one route's filter set to all requests reaching that backend. In Gateway deployments where backendRef filters set security-sensitive headers, such as tenant identity, authorization context, or values the backend trusts, an attacker who can create an accepted HTTPRoute sharing the same backend Service:port may cause their route's filter context to be applied to another route's requests, potentially crossing namespace boundaries when a ReferenceGrant permits cross-namespace targeting. This issue is fixed in version v3.7.6.

• CWE-284
• CWE-863

• https://github.com/traefik/traefik/commit/8aada7a7d52e4588a75386d8b86d270f6fe8d549Patch
• https://github.com/traefik/traefik/pull/13367Issue Tracking
• https://github.com/traefik/traefik/releases/tag/v3.7.6Release Notes
• https://github.com/traefik/traefik/security/advisories/GHSA-6p8f-p8j2-rqmvPatch, Vendor Advisory

Published

Jul 6, 2026

Last Modified

Jul 8, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5476A vulnerability was identified in NASA cFS up to 7.0.0 on 32…4.6
• CVE-2026-54760Langroid is a framework for building large-language-model-po…9.3
• CVE-2026-54761Traefik is an HTTP reverse proxy and load balancer. Prior to…7.1
• CVE-2026-54762Traefik is an HTTP reverse proxy and load balancer. From 3.7…8.6
• CVE-2026-54763Traefik is an HTTP reverse proxy and load balancer. Prior to…10
• CVE-2026-54764Traefik is an HTTP reverse proxy and load balancer. Prior to…5.8
• CVE-2026-54768WPGraphQL provides a GraphQL API for WordPress sites. From 2…6.9
• CVE-2026-54769Langroid is a framework for building large-language-model-po…10
• CVE-2026-5477An integer overflow existed in the wolfCrypt CMAC implementa…7.5
• CVE-2026-54771Langroid is a framework for building large-language-model-po…8.1
• CVE-2026-54772CoreWCF is a port of the service side of Windows Communicati…7.5
• CVE-2026-54773CoreWCF is a port of the service side of Windows Communicati…5.9