Traefik versions 3.7.0 through 3.7.6 incorrectly resolved HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef by using the backend Service’s namespace instead of the HTTPRoute's namespace. This namespace confusion allows a low‑privileged route author who has a ReferenceGrant to a cross‑namespace Service to bind a Middleware from a different namespace without a separate grant, potentially injecting trusted reverse‑proxy identity headers into downstream requests. The description does not explicitly state that this leads to privilege escalation; however, the inferred consequence is that if downstream services blindly trust those headers, an attacker could achieve impersonation or unauthorized access.

Traefik 3.7.0 to 3.7.6, implemented as a Kubernetes Gateway API provider, are affected. Any deployment that uses HTTPRoute resources with backend filter extension references can be impacted, as the bug resides in the provider component that processes these references.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of < 1% suggests a very low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have the ability to create or modify HTTPRoute objects and a ReferenceGrant to a cross‑namespace Service, which may not be trivial but is feasible for a low‑privileged route author. The risk is that the injected headers may be trusted by downstream services, potentially enabling impersonation or unauthorized access, but the description does not confirm a guaranteed privilege escalation.