Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.10, A tenant with write access to an HTTPRoute resource can inject backtick-delimited rule tokens into Traefik's router rule language via unsanitized header or query parameter match values. In shared gateway deployments, this can bypass listener hostname constraints and redirect traffic for victim hostnames to attacker-controlled backends. This vulnerability is fixed in 3.6.10.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
References
History
Wed, 11 Mar 2026 18:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 11 Mar 2026 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.10, A tenant with write access to an HTTPRoute resource can inject backtick-delimited rule tokens into Traefik's router rule language via unsanitized header or query parameter match values. In shared gateway deployments, this can bypass listener hostname constraints and redirect traffic for victim hostnames to attacker-controlled backends. This vulnerability is fixed in 3.6.10. | |
| Title | Traefik has a kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values | |
| Weaknesses | CWE-74 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-03-11T17:22:36.189Z
Reserved: 2026-03-04T16:26:02.898Z
Link: CVE-2026-29777
Vulnrichment
Updated: 2026-03-11T17:22:25.497Z
NVD
Status : Received
Published: 2026-03-11T16:16:40.830
Modified: 2026-03-11T16:16:40.830
Link: CVE-2026-29777
Redhat
No data.
OpenCVE Enrichment
No data.