VulnerabilityAnalyzed

CVE-2026-29777

Prior to 3.6.10, A tenant with write access to an HTTPRoute resource can inject backtick-delimited rule tokens into Traefik's router rule language via unsanitized header or query parameter match values.

MEDIUM 6.1EPSS 0.28%

Does this matter?

Lower severity and a low EPSS score (0.28%). Track it; it rarely justifies an emergency change on its own.

Description

Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.10, A tenant with write access to an HTTPRoute resource can inject backtick-delimited rule tokens into Traefik's router rule language via unsanitized header or query parameter match values. In shared gateway deployments, this can bypass listener hostname constraints and redirect traffic for victim hostnames to attacker-controlled backends. This vulnerability is fixed in 3.6.10.

CVSS 4.0: 6.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.28% probability · 20th percentile
CISA KEV: Not listed
Weakness: CWE-74
Affected: traefik/traefik
Source: security-advisories@github.com

References

https://github.com/traefik/traefik/releases/tag/v3.6.10Release Notes
https://github.com/traefik/traefik/security/advisories/GHSA-8q2w-wr49-whqjVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.