Junglewise Threat Intelligence

CVE-2026-32695: Traefik router rule injection in Kubernetes providers

CVE-2026-32695 · Severity: high · CVSS 7.7 · Published 2026-03-27

Technologies: Traefik Labs Traefik Proxy, Traefik, github.com/traefik/traefik/v3 (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik (Go). Vendors: Traefik Labs, Traefik, Red Hat, Go.

Executive brief

Traefik, a popular open-source tool used to route and manage web traffic, contains a security flaw in how it handles certain configuration rules for Kubernetes environments. In shared or multi-tenant systems, an attacker could provide specially crafted values that trick the system into bypassing intended access restrictions. This could allow unauthorized users to intercept or redirect traffic meant for other customers or services, potentially exposing sensitive data.

Technical details

A rule injection vulnerability exists in Traefik's Kubernetes-related providers (Knative, Ingress, and Ingress-NGINX) due to unsafe string interpolation. The software uses fmt.Sprintf to build router rules by placing user-controlled values into backtick-delimited literals without proper escaping. An attacker with the ability to create or modify Kubernetes resources (such as Knative Ingress) can inject backticks to terminate the literal and append malicious operators (e.g., '|| Host(`attacker.com`)'). This results in a router that serves traffic for unauthorized domains, leading to cross-tenant traffic exposure. The issue is addressed in versions 3.6.11 and 3.7.0-ea.2 by implementing safer rule construction.

Affected products

  • traefik traefik < 3.6.11, >= 3.7.0-ea.1, < 3.7.0-ea.2
  • Red Hat Red Hat OpenShift Dev Spaces 3.27 3.27

Timeline

  • 2026-03-19: patched: Versions 3.6.11 and 3.7.0-ea.2 released
  • 2026-03-27: advisory: GitHub Security Advisory GHSA-67jx-r9pv-98rj published
  • 2026-03-27: disclosed: CVE-2026-32695 published to NVD

References

Related threats