CVE-2026-71327
published 2026-08-06CVE-2026-71327: Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in…
PriorityP346high7.6CVSS 4.0
AVNACLATPPRLUINVCHVIHVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.36%
29.6th percentile
Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go builds HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute router and service identities by hyphen-concatenating namespace, route name, Gateway identity, entry point, and rule index, allowing colliding Routes to overwrite another namespace's backend. This issue is fixed in 3.6.25 and 3.7.10.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devspaces | traefik-rhel9 | — | — |
| github.com | traefik_traefik_v3 | >= 3.0.0 < 3.6.25 | 3.6.25 |
| github.com | traefik_traefik_v3 | >= 3.7.0 < 3.7.10 | 3.7.10 |
| traefik | traefik | — | — |
| traefik | traefik | — | — |
CVSS provenance
nvdv4.07.6HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Traefik up to 3.6.24/3.7.9 Kubernetes Gateway API Provider httproute.go race condition
vuldb·2026-08-07·CVSS 7.6
CVE-2026-71327 [HIGH] Traefik up to 3.6.24/3.7.9 Kubernetes Gateway API Provider httproute.go race condition
A vulnerability has been found in Traefik up to 3.6.24/3.7.9 and classified as problematic. Affected by this issue is some unknown functionality of the file pkg/provider/kubernetes/gateway/httproute.go of the component Kubernetes Gateway API Provider. This manipulation causes race condition.
This vulnerability appears as CVE-2026-71327. The attack may be initiated remotely. There is no available exploit.
The affected component should be upgraded.
GHSA
Traefik: Gateway API route identity collision allows cross-namespace backend hijacking
ghsa·2026-08-06
CVE-2026-71327 [HIGH] CWE-694 Traefik: Gateway API route identity collision allows cross-namespace backend hijacking
Traefik: Gateway API route identity collision allows cross-namespace backend hijacking
## Summary
There is a high severity vulnerability in Traefik's Kubernetes Gateway API provider. Router and service identities for `HTTPRoute`, `GRPCRoute`, `TCPRoute` and `TLSRoute` objects were built by hyphen-concatenating the route namespace, the route name, the Gateway identity, the entry point and the rule index, a construction that is not injective because Kubernetes names may themselves contain hyphens. Two distinct Routes attached to the same Gateway with equivalent match rules can therefore produce the same identity, and the Route loaded later silently overwrites the earlier one, so a tenant able to create an accepted Route in a colliding namespace/name combination can redirect another namespa
Red Hat
github.com/traefik/traefik: Traefik: Cross-namespace backend hijacking due to Gateway API identity collision
vendor_redhat·2026-08-06·CVSS 7.6
CVE-2026-71327 [HIGH] CWE-1220 github.com/traefik/traefik: Traefik: Cross-namespace backend hijacking due to Gateway API identity collision
github.com/traefik/traefik: Traefik: Cross-namespace backend hijacking due to Gateway API identity collision
Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go builds HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute router and service identities by hyphen-concatenating namespace, route name, Gateway identity, entry point, and rule index, allowing colliding Routes to overwrite another namespace's backend. This issue is fixed in 3.6.25 and 3.7.10.
A flaw was found in Traefik, an open-source HTTP reverse proxy and load balancer. Its Kubernetes Gateway API provider incorrectly generates unique identifiers for routes
No detection rules found.
No public exploits indexed.
https://github.com/traefik/traefik/commit/a764166656f0cd337f917ac76315c381cca844f9https://github.com/traefik/traefik/pull/13580https://github.com/traefik/traefik/releases/tag/v3.6.25https://github.com/traefik/traefik/releases/tag/v3.7.10https://github.com/traefik/traefik/security/advisories/GHSA-fgjj-px3w-67xx
2026-08-06
Published