CVE-2026-71327 Details
Description
Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go builds HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute router and service identities by hyphen-concatenating namespace, route name, Gateway identity, entry point, and rule index, allowing colliding Routes to overwrite another namespace's backend. This issue is fixed in 3.6.25 and 3.7.10.
A vulnerability exists in Traefik's Kubernetes Gateway API provider, specifically in versions 3.0.0 prior to 3.6.25 and 3.7.0 prior to 3.7.10. The issue arises because the provider constructs router and service identities for HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute by concatenating the namespace, route name, Gateway identity, entry point, and rule index with hyphens. This method can lead to collisions, allowing Routes from different namespaces to interfere with each other's backends. A tenant could exploit this by creating a Route that overwrites another namespace's traffic routing.
Users should upgrade to Traefik versions 3.6.25 or 3.7.10, both of which include the necessary fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/traefik/traefik/commit/a764166656f0cd337f917ac76315c381cca844f9 | [email protected] | Patch |
| https://github.com/traefik/traefik/pull/13580 | [email protected] | Issue TrackingPatch |
| https://github.com/traefik/traefik/releases/tag/v3.6.25 | [email protected] | PatchRelease Notes |
| https://github.com/traefik/traefik/releases/tag/v3.7.10 | [email protected] | PatchRelease Notes |
| https://github.com/traefik/traefik/security/advisories/GHSA-fgjj-px3w-67xx | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-694 | Use of Multiple Resources with Duplicate Identifier | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| traefik traefik | >= 3.0.0, < 3.6.25 >= 3.7.0, < 3.7.10 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | Initial Analysis | [email protected] |
| Aug 7, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | New CVE Received | [email protected] |