CVE-2026-54761: Traefik broken access control (CVSS 7.1)

Description

Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.21 and 3.7.5, there is a high severity vulnerability in Traefik's Kubernetes Gateway provider affecting the crossProviderNamespaces allowlist. For HTTPRoute rules that declare multiple (WRR) backendRefs, Traefik evaluates the allowlist against the target backendRef.namespace instead of the route's own namespace. As a result, an HTTPRoute created in a namespace that is not allow-listed can reference a cross-provider TraefikService such as api@internal, dashboard@internal or rest@internal by pointing backendRef.namespace at an allow-listed namespace covered by a Gateway API ReferenceGrant, exposing internal Traefik services on the data plane. Exploitation requires the ability to create an accepted HTTPRoute and a matching ReferenceGrant from an allow-listed namespace; it does not require any change to Traefik static configuration, RBAC, or the deployment itself. This vulnerability is fixed in 3.6.21 and 3.7.5.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityLow

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Affected products

Traefik≥ 3.7.0 < 3.7.5 · < 3.6.21

Remediation

Fixed in

Traefik≥ 3.7.5

Patch & vendor advisories

References

https://github.com/traefik/traefik/releases/tag/v3.6.21Release NotesPatch
https://github.com/traefik/traefik/releases/tag/v3.7.5Release NotesPatch
https://github.com/traefik/traefik/security/advisories/GHSA-3g6v-2r68-prfcExploitMitigationPatchVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-54761 being actively exploited?

CVE-2026-54761 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.37%.

How severe is CVE-2026-54761?

CVE-2026-54761 has a CVSS 3.1 base score of 7.1, rated high. EPSS estimates a 0.37% probability of exploitation.

Which products are affected by CVE-2026-54761?

Affected products include Traefik.

How do I fix CVE-2026-54761?

Upgrade affected software to a fixed version, for example Traefik 3.7.5 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-54761 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo