CVE-2026-32695
published 2026-03-27CVE-2026-32695: Traefik is an HTTP reverse proxy and load balancer. Prior to versions 3.6.11 and 3.7.0-ea.2, Traefik's Knative provider builds router rules by interpolating…
PriorityP348high7.7CVSS 3.1
AVNACLPRLUINSCCHINAN
EPSS
0.46%
38.8th percentile
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 3.6.11 and 3.7.0-ea.2, Traefik's Knative provider builds router rules by interpolating user-controlled values into backtick-delimited rule expressions without escaping. In live cluster validation, Knative `rules[].hosts[]` was exploitable for host restriction bypass (for example `tenant.example.com`) || Host(`attacker.com`), producing a router that serves attacker-controlled hosts. Knative `headers[].exact` also allows rule-syntax injection and proves unsafe rule construction. In multi-tenant clusters, this can route unauthorized traffic to victim services and lead to cross-tenant traffic exposure. Versions 3.6.11 and 3.7.0-ea.2 patch the issue.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | traefik_traefik_v2 | 0 – 2.11.42 | — |
| github.com | traefik_traefik_v3 | >= 0 < 3.6.11 | 3.6.11 |
| github.com | traefik_traefik_v3 | >= 3.7.0-ea.1 < 3.7.0-ea.2 | 3.7.0-ea.2 |
| traefik | traefik | < 3.6.11 | 3.6.11 |
| traefik | traefik | — | — |
| traefik | traefik | — | — |
CVSS provenance
nvdv3.17.7HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Traefik up to 3.6.10 injection
vuldb·2026-07-01·CVSS 7.7
CVE-2026-32695 [HIGH] Traefik up to 3.6.10 injection
A vulnerability, which was classified as problematic, has been found in Traefik up to 3.6.10. Affected by this issue is some unknown functionality. This manipulation causes injection.
This vulnerability appears as CVE-2026-32695. The attack may be initiated remotely. There is no available exploit.
It is advisable to upgrade the affected component.
OSV
Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass in github.com/traefik/traefik
osv·2026-04-02
CVE-2026-32695 Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass in github.com/traefik/traefik
Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass in github.com/traefik/traefik
Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass in github.com/traefik/traefik
GHSA
Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass
ghsa·2026-03-27
CVE-2026-32695 [MEDIUM] CWE-74 Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass
Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass
## Summary
There is a potential vulnerability in Traefik's Kubernetes Knative, Ingress, and Ingress-NGINX providers related to rule injection.
User-controlled values are interpolated into backtick-delimited Traefik router rule expressions without escaping or validation. A malicious value containing a backtick can terminate the literal and inject additional operators into Traefik's rule language, altering the parsed rule tree. In shared or multi-tenant deployments, this can bypass host and header routing constraints and redirect unauthorized traffic to victim services.
## Patches
- https://github.com/traefik/traefik/releases/tag/v3.6.11
- https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.2
## For mo
OSV
Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass
osv·2026-03-27
CVE-2026-32695 [MEDIUM] Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass
Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass
## Summary
There is a potential vulnerability in Traefik's Kubernetes Knative, Ingress, and Ingress-NGINX providers related to rule injection.
User-controlled values are interpolated into backtick-delimited Traefik router rule expressions without escaping or validation. A malicious value containing a backtick can terminate the literal and inject additional operators into Traefik's rule language, altering the parsed rule tree. In shared or multi-tenant deployments, this can bypass host and header routing constraints and redirect unauthorized traffic to victim services.
## Patches
- https://github.com/traefik/traefik/releases/tag/v3.6.11
- https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.2
## For mo
Red Hat
github.com/traefik/traefik: Traefik: Cross-tenant traffic exposure and host restriction bypass via rule-syntax injection in Knative provider
vendor_redhat·2026-03-27·CVSS 6.3
CVE-2026-32695 [MEDIUM] CWE-917 github.com/traefik/traefik: Traefik: Cross-tenant traffic exposure and host restriction bypass via rule-syntax injection in Knative provider
github.com/traefik/traefik: Traefik: Cross-tenant traffic exposure and host restriction bypass via rule-syntax injection in Knative provider
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 3.6.11 and 3.7.0-ea.2, Traefik's Knative provider builds router rules by interpolating user-controlled values into backtick-delimited rule expressions without escaping. In live cluster validation, Knative `rules[].hosts[]` was exploitable for host restriction bypass (for example `tenant.example.com`) || Host(`attacker.com`), producing a router that serves attacker-controlled hosts. Knative `headers[].exact` also allows rule-syntax injection and proves unsafe rule construction. In multi-tenant clusters, this can route unauthorized traffic to victim services and lead to cross-tenant
No detection rules found.
No public exploits indexed.
https://github.com/traefik/traefik/releases/tag/v3.6.11https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.2https://github.com/traefik/traefik/security/advisories/GHSA-67jx-r9pv-98rjhttps://access.redhat.com/errata/RHSA-2026:10175https://access.redhat.com/security/cve/CVE-2026-32695https://bugzilla.redhat.com/show_bug.cgi?id=2452235https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32695.json
2026-03-27
Published