---
id: CVE-2026-71327
title: Traefik is an open source HTTP reverse proxy and load balancer
summary: >-
  Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0
  until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in
  pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and
  tlsroute.go bui…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-694
  - CWE-1220
vendor: traefik
product: traefik
affected:
  - 'traefik >= 3.0.0, < 3.6.25'
  - 'traefik >= 3.7.0, < 3.7.10'
patched:
  - traefik 3.7.10
published: '2026-08-06'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T20:44:53.467'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71327'
references:
  - url: >-
      https://github.com/traefik/traefik/commit/a764166656f0cd337f917ac76315c381cca844f9
    label: security-advisories@github.com
  - url: 'https://github.com/traefik/traefik/pull/13580'
    label: security-advisories@github.com
  - url: 'https://github.com/traefik/traefik/releases/tag/v3.6.25'
    label: security-advisories@github.com
  - url: 'https://github.com/traefik/traefik/releases/tag/v3.7.10'
    label: security-advisories@github.com
  - url: 'https://github.com/traefik/traefik/security/advisories/GHSA-fgjj-px3w-67xx'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-fgjj-px3w-67xx'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-71327.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-71327'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2512294'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-71327'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71327'
tags:
  - nvd
  - ghsa
  - go
  - csaf
  - vex
  - red-hat
epss: 0.00481
epssPercentile: 0.38998
aliases:
  - GHSA-fgjj-px3w-67xx
ecosystem: go
scores:
  nvd: 8.1
  ghsa: 8.2
  vendor: 8.5
ingestedAt: '2026-08-06T17:00:12.837Z'
---

## Overview

Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go builds HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute router and service identities by hyphen-concatenating namespace, route name, Gateway identity, entry point, and rule index, allowing colliding Routes to overwrite another namespace's backend. This issue is fixed in 3.6.25 and 3.7.10.

## Affected

- `traefik >= 3.0.0, < 3.6.25`
- `traefik >= 3.7.0, < 3.7.10`

## Remediation

Upgrade past the affected range:

- `traefik 3.7.10`

## Package advisory (CVE-2026-71327)

Affected packages:

- `github.com/traefik/traefik/v3 >= 3.0.0, < 3.6.25`
- `github.com/traefik/traefik/v3 >= 3.7.0, < 3.7.10`

Patched in:

- `github.com/traefik/traefik/v3 3.6.25`
- `github.com/traefik/traefik/v3 3.7.10`

Source: https://github.com/advisories/GHSA-fgjj-px3w-67xx

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat OpenShift Dev Spaces · no fix planned: Red Hat OpenShift Dev Spaces · updated 2026-09-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-71327.json)