Medium severity6.5NVD Advisory· Published Mar 11, 2026· Updated Jun 17, 2026
CVE-2026-29777
CVE-2026-29777
Description
Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.10, A tenant with write access to an HTTPRoute resource can inject backtick-delimited rule tokens into Traefik's router rule language via unsanitized header or query parameter match values. In shared gateway deployments, this can bypass listener hostname constraints and redirect traffic for victim hostnames to attacker-controlled backends. This vulnerability is fixed in 3.6.10.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/traefik/traefik/v3Go | < 3.6.10 | 3.6.10 |
github.com/traefik/traefikGo | <= 1.7.34 | — |
github.com/traefik/traefik/v2Go | <= 2.11.40 | — |
Affected products
10- osv-coords8 versionspkg:apk/chainguard/traefik-2.11pkg:apk/chainguard/traefik-fips-2.11pkg:golang/github.com/traefik/traefikpkg:golang/github.com/traefik/traefik/v2pkg:golang/github.com/traefik/traefik/v3pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/traefik&distro=openSUSE%20Tumbleweed
< 2.11.42-r0+ 7 more
- (no CPE)range: < 2.11.42-r0
- (no CPE)range: < 2.11.41-r0
- (no CPE)range: <= 1.7.34
- (no CPE)range: <= 2.11.40
- (no CPE)range: < 3.6.10
- (no CPE)range: < 0.0.20260317T205859-150000.1.152.1
- (no CPE)range: < 0.0.20260723T184607-160000.1.1
- (no CPE)range: < 3.6.10-2.1
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-8q2w-wr49-whqjghsaADVISORY
- github.com/traefik/traefik/security/advisories/GHSA-8q2w-wr49-whqjnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-29777ghsaADVISORY
- github.com/traefik/traefik/releases/tag/v3.6.10nvdRelease NotesWEB
News mentions
0No linked articles in our index yet.