CVE-2026-71327High· 8.1▾ TwilightTraefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go bui…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
8.2 → 8.1
Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go builds HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute router and service identities by hyphen-concatenating namespace, route name, Gateway identity, entry point, and rule index, allowing colliding Routes to overwrite another namespace's backend. This issue is fixed in 3.6.25 and 3.7.10.
traefik >= 3.0.0, < 3.6.25traefik >= 3.7.0, < 3.7.10Upgrade past the affected range:
traefik 3.7.10Affected packages:
github.com/traefik/traefik/v3 >= 3.0.0, < 3.6.25github.com/traefik/traefik/v3 >= 3.7.0, < 3.7.10Patched in:
github.com/traefik/traefik/v3 3.6.25github.com/traefik/traefik/v3 3.7.10Source: https://github.com/advisories/GHSA-fgjj-px3w-67xx
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-71326Low· 3.8Traefik is an open source HTTP reverse proxy and load balancer
CVE-2026-71325Medium· 4.4Traefik is an open-source edge router that makes publishing services a fun and easy experience
CVE-2026-85594Critical· 9.8Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider
CVE-2026-71324Critical· 9.1Traefik is an open source HTTP reverse proxy and load balancer
CVE-2026-88877Critical· 9.8Traefik is a HTTP reverse proxy and load balancer
CVE-2026-88878Medium· 5.3Traefik is an HTTP reverse proxy and load balancer