Most recent entries from all

certfr-2026-avi-0823 — De multiples vulnérabilités ont été découvertes dans Traefik. Elles permettent à un attaquant de provoquer un contourne…

2026-10-04T05:47:04.860572+00:00

certfr-2026-avi-0823

EUVD-2026-333678

2026-10-04T05:47:04.860610+00:00

EUVD-2026-333678

fkie_cve-2026-54765

2026-10-04T05:47:04.860625+00:00

Traefik is an open source HTTP reverse proxy and load balancer. From v3.7.0 prior to v3.7.6, Traefik's Kubernetes Gateway API provider may resolve two accepted HTTPRoutes that target the same backend Service:port but configure different backendRef filters to the same child service and apply only one route's filter set to all requests reaching that backend. In Gateway deployments where backendRef filters set security-sensitive headers, such as tenant identity, authorization context, or values the backend trusts, an attacker who can create an accepted HTTPRoute sharing the same backend Service:port may cause their route's filter context to be applied to another route's requests, potentially crossing namespace boundaries when a ReferenceGrant permits cross-namespace targeting. This issue is fixed in version v3.7.6.

GHSA-6p8f-p8j2-rqmv — Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port

2026-10-04T05:47:04.860659+00:00

Affected: Go: github.com/traefik/traefik/v3

## Summary

There is a medium severity vulnerability in Traefik's Kubernetes Gateway API provider. When two accepted HTTPRoutes target the same backend Service:port but configure different `backendRef` filters, Traefik may resolve both routes to the same child service and apply only one route's filter set to all requests reaching that backend. In Gateway deployments where `backendRef` filters set security-sensitive headers — such as tenant identity, authorization context, or values the backend trusts — an attacker who can create an accepted HTTPRoute sharing the same backend Service:port may cause their route's filter context to be applied to another route's requests, potentially crossing namespace boundaries when a `ReferenceGrant` permits cross-namespace targeting.

## Patches

- https://github.com/traefik/traefik/releases/tag/v3.7.6

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

Original Description

# Traefik Gateway HTTPRoute backendRef filter context collision across routes sharing Service:port

## Summary

Traefik's Kubernetes Gateway API provider builds the dynamic HTTP backend service key for a Gateway `HTTPRoute` backendRef from only the backend namespace, Service name, protocol, and port. It does not include the HTTPRoute, listener, rule, or backendRef filter identity in that key.

When two accepted HTTPRoutes point to the same bac…

openSUSE-SU-2026:11251-1 — traefik-3.7.7-1.1 on GA media

2026-10-04T05:47:04.860729+00:00

traefik-3.7.7-1.1 on GA media