CVE-2026-71327

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 3.6.25 Traefik versions prior to 3.7.10

Description Traefik's Kubernetes Gateway API provider incorrectly constructs router and service identities for HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute objects by hyphen-concatenating the namespace, route name, Gateway identity, entry point, and rule index. Because Kubernetes names can contain hyphens, this construction is not injective, meaning two different routes can produce the same identity. An attacker with permission to create a route in a colliding namespace or name combination can cause their route to overwrite another namespace's backend. This allows the attacker to redirect traffic, including credentials and authorization headers, to a backend they control.

Recommendations Update Traefik to version 3.6.25. Update Traefik to version 3.7.10.