Traefik, an open source HTTP reverse proxy and load balancer, contains a logic error in its Kubernetes Gateway API provider from v3.7.0 through v3.7.5. When two accepted HTTPRoutes target the same backend Service:port but specify different backendRef filters, only one route’s filter set contains security‑sensitive headers—such as tenant identity or authorization context—and the malicious route’s header context can be inadvertently propagated to other routes, exposing or manipulating sensitive context. The routine CWE labels for this flaw are unauthorized access (CWE‑284) and improper identifier handling (CWE‑863).

Only Traefik deployments that enable the Kubernetes Gateway API provider and accept HTTPRoutes are impacted. The flaw manifests when two accepted HTTPRoutes target the same backend Service:port but configure differing backendRef filters; in such cases, only one route’s filter set is applied, potentially leaking security‑sensitive headers to other routes. This can affect multiple namespaces when ReferenceGrants allow cross‑namespace targeting, but is not present in Traefik configurations that do not use the Kubernetes Gateway API. The inference that cross‑namespace leakage can occur follows from the description of ReferenceGrants, which enable cross‑namespace targeting in the Gateway. The risk is real for deployments that enable the provider and allow HTTPRoute creation.

The CVSS score of 6.3 reflects a moderate impact; the EPSS score of < 1% and the vulnerability is not listed in the CISA KEV. In environments where ReferenceGrants allow cross‑namespace access, the attacker can potentially leak authentication or authorization information into another namespace, leading to privilege escalation or data exposure. It is inferred that cross‑namespace leakage may occur due to ReferenceGrant allowing cross‑namespace targeting. No separate exploitation conditions are documented beyond the need to create or modify HTTPRoutes and share the same backend Service:port.