CVSS 4.0
6.1 mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:NCVE-2026-29777
Medium (6.1) in traefik traefik. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/traefik/traefik/v3 3.6.10.
Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.10, A tenant with write access to an HTTPRoute resource can inject backtick-delimited rule tokens into Traefik's router rule language via unsanitized header or query parameter match values. In shared gateway deployments, this can bypass listener hostname constraints and redirect traffic for victim hostnames to attacker-controlled backends. This vulnerability is fixed in 3.6.10.
Severity
CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 22% of CVEs (scores of 2026-10-31)
- CWE
- CWE-74
- Published
- Modified
- Record from
- the NVD, synced
Affected
- traefik:traefik
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8q2w-wr49-whqj | Go | github.com/traefik/traefik/v3 | <3.6.10 | 3.6.10 |
| GHSA-8q2w-wr49-whqj | Go | github.com/traefik/traefik | <=1.7.34 | no fix published |
| GHSA-8q2w-wr49-whqj | Go | github.com/traefik/traefik/v2 | <=2.11.40 | no fix published |
| GO-2026-4679 | Go | github.com/traefik/traefik | all versions | no fix published |
| GO-2026-4679 | Go | github.com/traefik/traefik/v2 | all versions | no fix published |
| GO-2026-4679 | Go | github.com/traefik/traefik/v3 | <3.6.10 | 3.6.10 |