What’s Vulnerable › Vulnerabilities

CVE-2026-29777: Traefik has a kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-11 · updated 2026-06-17
• Weakness: CWE-74

Description

Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.10, A tenant with write access to an HTTPRoute resource can inject backtick-delimited rule tokens into Traefik's router rule language via unsanitized header or query parameter match values. In shared gateway deployments, this can bypass listener hostname constraints and redirect traffic for victim hostnames to attacker-controlled backends. This vulnerability is fixed in 3.6.10.

Affected products

• Traefik: before 3.6.10 — fixed in 3.6.10

How to fix

Upgrade to a fixed version: Traefik 3.6.10. Check the vendor advisory for mitigations.

References

• https://github.com/traefik/traefik/releases/tag/v3.6.10
• https://github.com/traefik/traefik/security/advisories/GHSA-8q2w-wr49-whqj

Get alerted when CVE-2026-29777 or the next vulnerability affects your stack