Skip to content
fr Sign in
6.3 Medium

CVE-2026-32695 Traefik is an HTTP reverse proxy and load balancer

Description

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 3.6.11 and 3.7.0-ea.2, Traefik's Knative provider builds router rules by interpolating user-controlled values into backtick-delimited rule expressions without escaping. In live cluster validation, Knative `rules[].hosts[]` was exploitable for host restriction bypass (for example `tenant.example.com`) || Host(`attacker.com`), producing a router that serves attacker-controlled hosts. Knative `headers[].exact` also allows rule-syntax injection and proves unsafe rule construction. In multi-tenant clusters, this can route unauthorized traffic to victim services and lead to cross-tenant traffic exposure. Versions 3.6.11 and 3.7.0-ea.2 patch the issue.

Affected products and versions

Product Affected versions Fixed in
traefik 3.7 3.7.0-ea.1 → < 3.7.0-ea.2 3.7.0-ea.2
traefik 3.6 earliest → < 3.6.11 3.6.11
Red Hat OpenShift Dev Spaces 3.27 1776718585 earliest → < 1776718585 1776718585

References

Timeline

  1. Published
  2. Last modified

Other CVEs of traefik

The 80 CVEs of traefik →
CVE-2026-121966 Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak 7.0 High CVE-2026-119574 Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated… 8.2 High CVE-2026-119573 Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the… 2.1 Low CVE-2026-119572 Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider 7.0 High
Track this CVE