Traefik is an open source HTTP reverse proxy and load balancer. From v3.7.0 prior to v3.7.6, Traefik's Kubernetes Gateway API provider may resolve two accepted HTTPRoutes that target the same backend Service:port but configure different backendRef filters to the same child service and apply only one route's filter set to all requests reaching that backend. In Gateway deployments where backendRef filters set security-sensitive headers, such as tenant identity, authorization context, or values the backend trusts, an attacker who can create an accepted HTTPRoute sharing the same backend Service:port may cause their route's filter context to be applied to another route's requests, potentially crossing namespace boundaries when a ReferenceGrant permits cross-namespace targeting. This issue is fixed in version v3.7.6.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Traefik is an open source HTTP reverse proxy and load balancer. From v3.7.0 prior to v3.7.6, Traefik's
    Kubernetes Gateway API provider may resolve two accepted HTTPRoutes that target the same backend
    Service:port but configure different backendRef filters to the same child service and apply only one
    route's filter set to all requests reaching that backend. In Gateway deployments where backendRef filters
    set security-sensitive headers, such as tenant identity, authorization context, or values the backend
    trusts, an attacker who can create an accepted HTTPRoute sharing the same backend Service:port may cause
    their route's filter context to be applied to another route's requests, potentially crossing namespace
    boundaries when a ReferenceGrant permits cross-namespace targeting. This issue is fixed in version v3.7.6.
    (CVE-2026-54765)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 803b9816-77af-11f1-ba71-5404a68ad561 advisory.

    The traefik project releases a new version addressing multiple CVEs:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
445738	SCA: security update for github.com/traefik/traefik/v3 (GHSA-6p8f-p8j2-rqmv)	Tenable Cloud Security	SCA Checks	Local	medium
445738	SCA: security update for github.com/traefik/traefik/v3 (GHSA-6p8f-p8j2-rqmv)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
325234	FreeBSD : traefik -- Multiple vulnerabilities (803b9816-77af-11f1-ba71-5404a68ad561)	Nessus	FreeBSD Local Security Checks	Local	high

Detections

Analytics

CVE-2026-54765

medium

Tenable Plugins

medium

medium

high