Executive brief
A security flaw in Traefik Proxy's Kubernetes Gateway integration allows a malicious user to hijack web traffic intended for other departments or applications. By carefully naming their own network routes to overlap with existing ones, an attacker can trick the system into redirecting sensitive data, such as login credentials or private customer information, to a server they control. This could lead to data theft, service disruption, or the delivery of fraudulent content to users.
Technical details
A vulnerability exists in Traefik's Kubernetes Gateway API provider where internal identities for HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute are generated by concatenating fields (namespace, name, gateway, etc.) using hyphens. Because Kubernetes resource names can also contain hyphens, this construction is not injective, leading to collisions (e.g., namespace 'team' + route 'a-app' vs namespace 'team-a' + route 'app'). When Traefik merges configurations, the route loaded later silently overwrites the earlier one in the internal map. An attacker with permission to create routes in a shared Gateway environment can exploit this to redirect traffic from a victim's namespace to an attacker-controlled backend. Patches are available in versions 3.6.25 and 3.7.10.
Affected products
- Traefik Labs Traefik Proxy >= 3.0.0, < 3.6.25; >= 3.7.0, < 3.7.10
Timeline
- 2026-08-03: advisory: GitHub Advisory published
- 2026-08-06: disclosed: Public disclosure date