CVE-2026-32695 — Injection in Traefik

CWE-74 — InjectionCWE-917 — Expression Language Injection7 documents6 sources
Severity
6.3MEDIUMNVD
EPSS
0.0%
top 97.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
TraefikGithub.com Traefik Traefik V3Github.com Traefik Traefik V2
Timeline
PublishedMar 27
Latest updateApr 2

Description

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 3.6.11 and 3.7.0-ea.2, Traefik's Knative provider builds router rules by interpolating user-controlled values into backtick-delimited rule expressions without escaping. In live cluster validation, Knative `rules[].hosts[]` was exploitable for host restriction bypass (for example `tenant.example.com`) || Host(`attacker.com`), producing a router that serves attacker-controlled hosts. Knative `headers[].exact` also allows rule-sy…

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Affected Packages4 packages

▶CVEListV5traefik/traefik< 3.6.11+1
▶NVDtraefik/traefik< 3.6.11+1
▶Gogithub.com/traefik_traefik_v33.7.0-ea.1 — 3.7.0-ea.2+1

Patches

Patch: github.com ↗

🔴Vulnerability Details

4
OSV
Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass in github.com/traefik/traefik↗2026-04-02
▶
GHSA
Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass↗2026-03-27
▶
OSV
Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass↗2026-03-27
▶
CVEList
Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass↗2026-03-27
▶

📋Vendor Advisories

1
Red Hat
github.com/traefik/traefik: Traefik: Cross-tenant traffic exposure and host restriction bypass via rule-syntax injection in Knative provider↗2026-03-27
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-32695 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-32695 — Injection in Traefik | cvebase