Moderate severityNVD Advisory· Published Mar 11, 2026· Updated Mar 11, 2026
Traefik has a kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values
CVE-2026-29777
Description
Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.10, A tenant with write access to an HTTPRoute resource can inject backtick-delimited rule tokens into Traefik's router rule language via unsanitized header or query parameter match values. In shared gateway deployments, this can bypass listener hostname constraints and redirect traffic for victim hostnames to attacker-controlled backends. This vulnerability is fixed in 3.6.10.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/traefik/traefik/v3Go | < 3.6.10 | 3.6.10 |
github.com/traefik/traefikGo | <= 1.7.34 | — |
github.com/traefik/traefik/v2Go | <= 2.11.40 | — |
Affected products
8- osv-coords7 versionspkg:apk/chainguard/traefik-2.11pkg:apk/chainguard/traefik-fips-2.11pkg:golang/github.com/traefik/traefikpkg:golang/github.com/traefik/traefik/v2pkg:golang/github.com/traefik/traefik/v3pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/traefik&distro=openSUSE%20Tumbleweed
< 2.11.42-r0+ 6 more
- (no CPE)range: < 2.11.42-r0
- (no CPE)range: < 2.11.41-r0
- (no CPE)range: <= 1.7.34
- (no CPE)range: <= 2.11.40
- (no CPE)range: < 3.6.10
- (no CPE)range: < 0.0.20260317T205859-150000.1.152.1
- (no CPE)range: < 3.6.10-2.1
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-8q2w-wr49-whqjghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-29777ghsaADVISORY
- github.com/traefik/traefik/releases/tag/v3.6.10ghsax_refsource_MISCWEB
- github.com/traefik/traefik/security/advisories/GHSA-8q2w-wr49-whqjghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.