https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 07:04:22 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0268 certfr-2026-avi-0268 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0268 https://cve.radiocsirt.org/vuln/euvd-2026-275588 EUVD-2026-275588 https://cve.radiocsirt.org/vuln/euvd-2026-275588 https://cve.radiocsirt.org/vuln/fkie_cve-2026-29777 <p>Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.10, A tenant with write access to an HTTPRoute resource can inject backtick-delimited rule tokens into Traefik&#39;s router rule language via unsanitized header or query parameter match values. In shared gateway deployments, this can bypass listener hostname constraints and redirect traffic for victim hostnames to attacker-controlled backends. This vulnerability is fixed in 3.6.10.</p> <p>Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.10, A tenant with write access to an HTTPRoute resource can inject backtick-delimited rule tokens into Traefik&#39;s router rule language via unsanitized header or query parameter match values. In shared gateway deployments, this can bypass listener hostname constraints and redirect traffic for victim hostnames to attacker-controlled backends. This vulnerability is fixed in 3.6.10.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-29777 https://cve.radiocsirt.org/vuln/ghsa-8q2w-wr49-whqj <p><strong>Affected:</strong> Go: github.com/traefik/traefik/v3, Go: github.com/traefik/traefik, Go: github.com/traefik/traefik/v2</p> <p>## Summary</p> <p>There is a potential vulnerability in Traefik&#39;s Kubernetes Gateway provider related to rule injection.</p> <p>A tenant with write access to an HTTPRoute resource can inject backtick-delimited rule tokens into Traefik&#39;s router rule language via unsanitized header or query parameter match values. In shared gateway deployments, this can bypass listener hostname constraints and redirect traffic for victim hostnames to attacker-controlled backends.</p> <p>## Patches</p> <p>- https://github.com/traefik/traefik/releases/tag/v3.6.10</p> <p>## For more information</p> <p>If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).</p> <p>&lt;details&gt; &lt;summary&gt;Original Description&lt;/summary&gt;</p> <p>hey Traefik,</p> <p>repo: https://github.com/traefik/traefik commit: a4a91344edcdd6276c1b766ca19ee3f0e346480f (as-of 2026-03-02)</p> <p>traefik&#39;s kubernetes gateway provider builds router rules by interpolating HTTPRoute match values into the traefik rule language using backtick-delimited string literals (e.g., `Header(`name`,`value`)`, `Query(`name`,`value`)`) without escaping or validation.</p> <p>because backtick is a delimiter in the rule language, a tenant-controlled backtick can terminate the literal and inject additional rule tokens (for example `) || HostRegexp(`.\*`) || ...`). this changes the parsed ast so that an injected OR branch is not gated by the intended `Host(...)` constraint due to operator precedence, and can result in end-to-end routing hijack (victim host…</p> <p><strong>Affected:</strong> Go: github.com/traefik/traefik/v3, Go: github.com/traefik/traefik, Go: github.com/traefik/traefik/v2</p> <p>## Summary</p> <p>There is a potential vulnerability in Traefik&#39;s Kubernetes Gateway provider related to rule injection.</p> <p>A tenant with write access to an HTTPRoute resource can inject backtick-delimited rule tokens into Traefik&#39;s router rule language via unsanitized header or query parameter match values. In shared gateway deployments, this can bypass listener hostname constraints and redirect traffic for victim hostnames to attacker-controlled backends.</p> <p>## Patches</p> <p>- https://github.com/traefik/traefik/releases/tag/v3.6.10</p> <p>## For more information</p> <p>If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).</p> <p>&lt;details&gt; &lt;summary&gt;Original Description&lt;/summary&gt;</p> <p>hey Traefik,</p> <p>repo: https://github.com/traefik/traefik commit: a4a91344edcdd6276c1b766ca19ee3f0e346480f (as-of 2026-03-02)</p> <p>traefik&#39;s kubernetes gateway provider builds router rules by interpolating HTTPRoute match values into the traefik rule language using backtick-delimited string literals (e.g., `Header(`name`,`value`)`, `Query(`name`,`value`)`) without escaping or validation.</p> <p>because backtick is a delimiter in the rule language, a tenant-controlled backtick can terminate the literal and inject additional rule tokens (for example `) || HostRegexp(`.\*`) || ...`). this changes the parsed ast so that an injected OR branch is not gated by the intended `Host(...)` constraint due to operator precedence, and can result in end-to-end routing hijack (victim host…</p> https://cve.radiocsirt.org/vuln/ghsa-8q2w-wr49-whqj https://cve.radiocsirt.org/vuln/opensuse-su-2026:10385-1 <p>traefik-3.6.10-2.1 on GA media</p> <p>traefik-3.6.10-2.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10385-1