CVE-2026-71327: Traefik Proxy cross-namespace route hijacking via identity collision

CVE-2026-71327 · Severity: high · CVSS 8.2 · Published 2026-08-06

A security flaw in Traefik Proxy's Kubernetes Gateway integration allows a malicious user to hijack web traffic intended for other departments or applications. By carefully naming their own network routes to overlap with existing ones, an attacker can trick the system into redirecting sensitive data, such as login credentials or private customer information, to a server they control. This could lead to data theft, service disruption, or the delivery of fraudulent content to users.

Technologies: github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go), Traefik Labs Traefik Proxy. Vendors: Go, Traefik Labs.

Quick answers

Is CVE-2026-71327 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-71327 being exploited in the wild.
How severe is CVE-2026-71327?
High severity, with a CVSS score of 8.2, published 6 August 2026.
Which products and versions are affected?
github.com/traefik/traefik (Go) SEMVER:introduced=0; github.com/traefik/traefik/v2 (Go) SEMVER:introduced=0; github.com/traefik/traefik/v3 (Go) SEMVER:introduced=3.0.0,fixed=3.6.25, SEMVER:introduced=3.0.0,fixed=3.6.25,introduced=3.7.0,fixed=3.7.10; Traefik Labs Traefik Proxy >= 3.0.0, < 3.6.25; >= 3.7.0, < 3.7.10.
Is there a fix for CVE-2026-71327?
Yes. github.com/traefik/traefik/v3 (Go): upgrade to 3.6.25, 3.7.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71327 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-71327?
Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/traefik/traefik/v3 (Go): upgrade to 3.6.25, 3.7.10 or later
    go get github.com/traefik/traefik/v3@v3.7.10

Technical details

A vulnerability exists in Traefik's Kubernetes Gateway API provider where internal identities for HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute are generated by concatenating fields (namespace, name, gateway, etc.) using hyphens. Because Kubernetes resource names can also contain hyphens, this construction is not injective, leading to collisions (e.g., namespace 'team' + route 'a-app' vs namespace 'team-a' + route 'app'). When Traefik merges configurations, the route loaded later silently overwrites the earlier one in the internal map. An attacker with permission to create routes in a shared Gateway environment can exploit this to redirect traffic from a victim's namespace to an attacker-controlled backend. Patches are available in versions 3.6.25 and 3.7.10.

Affected products

  • Traefik Labs Traefik Proxy >= 3.0.0, < 3.6.25; >= 3.7.0, < 3.7.10

Identifiers

  • CVE-2026-71327
  • GHSA-fgjj-px3w-67xx
  • GO-2026-6209

Timeline

  • 2026-08-03: advisory: GitHub Advisory published
  • 2026-08-06: disclosed: Public disclosure date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.