CVE-2026-32695: Traefik router rule injection in Kubernetes providers

CVE-2026-32695 · Severity: high · CVSS 7.7 · Published 2026-03-27

Traefik, a popular open-source tool used to route and manage web traffic, contains a security flaw in how it handles certain configuration rules for Kubernetes environments. In shared or multi-tenant systems, an attacker could provide specially crafted values that trick the system into bypassing intended access restrictions. This could allow unauthorized users to intercept or redirect traffic meant for other customers or services, potentially exposing sensitive data.

Technologies: github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go), Traefik Labs Traefik Proxy. Vendors: Go, Traefik Labs.

Quick answers

Is CVE-2026-32695 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-32695 being exploited in the wild.
How severe is CVE-2026-32695?
High severity, with a CVSS score of 7.7, published 27 March 2026.
Which products and versions are affected?
github.com/traefik/traefik (Go) SEMVER:introduced=0; github.com/traefik/traefik/v2 (Go) SEMVER:introduced=0, SEMVER:introduced=0,last_affected=2.11.42; github.com/traefik/traefik/v3 (Go) SEMVER:introduced=0,fixed=3.6.11, SEMVER:introduced=0,fixed=3.6.11,introduced=3.7.0-ea.1,fixed=3.7.0-ea.2; Traefik Labs Traefik Proxy < 3.6.11, >= 3.7.0-ea.1, < 3.7.0-ea.2.
Is there a fix for CVE-2026-32695?
Yes. github.com/traefik/traefik/v3 (Go): upgrade to 3.6.11, 3.7.0-ea.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32695 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-32695?
Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/traefik/traefik/v3 (Go): upgrade to 3.6.11, 3.7.0-ea.2 or later
    go get github.com/traefik/traefik/v3@v3.7.0-ea.2

Technical details

A rule injection vulnerability exists in Traefik's Kubernetes-related providers (Knative, Ingress, and Ingress-NGINX) due to unsafe string interpolation. The software uses fmt.Sprintf to build router rules by placing user-controlled values into backtick-delimited literals without proper escaping. An attacker with the ability to create or modify Kubernetes resources (such as Knative Ingress) can inject backticks to terminate the literal and append malicious operators (e.g., '|| Host(`attacker.com`)'). This results in a router that serves traffic for unauthorized domains, leading to cross-tenant traffic exposure. The issue is addressed in versions 3.6.11 and 3.7.0-ea.2 by implementing safer rule construction.

Affected products

  • traefik traefik < 3.6.11, >= 3.7.0-ea.1, < 3.7.0-ea.2
  • Red Hat Red Hat OpenShift Dev Spaces 3.27 3.27

Identifiers

  • CVE-2026-32695
  • GHSA-67jx-r9pv-98rj
  • GO-2026-4880

Timeline

  • 2026-03-19: patched: Versions 3.6.11 and 3.7.0-ea.2 released
  • 2026-03-27: advisory: GitHub Security Advisory GHSA-67jx-r9pv-98rj published
  • 2026-03-27: disclosed: CVE-2026-32695 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.