HIGH 8.2 GitHub
CVE-2026-71327
Traefik: Gateway API route identity collision allows cross-namespace backend hijacking
## Summary
There is a high severity vulnerability in Traefik's Kubernetes Gateway API provider. Router and service identities for `HTTPRoute`, `GRPCRoute`, `TCPRoute` and `TLSRoute` objects were built by hyphen-concatenating the route namespace, the route name, the Gateway identity, the entry point and the rule index, a construction that is not injective because Kubernetes names may themselves contain hyphens. Two distinct Routes attached to the same Gateway with equivalent match rules can ther
Affected Products
- go/github.com/traefik/traefik/v3 >= 3.0.0, < 3.6.25
- go/github.com/traefik/traefik/v3 >= 3.7.0, < 3.7.10
References
- https://github.com/advisories/GHSA-fgjj-px3w-67xx
- https://github.com/traefik/traefik/security/advisories/GHSA-fgjj-px3w-67xx
- https://github.com/traefik/traefik/pull/13580
- https://github.com/traefik/traefik/commit/a764166656f0cd337f917ac76315c381cca844f9
This high severity vulnerability with a CVSS score of 8.2 was published on 2026-08-06 via GitHub. Affected: go/github.com/traefik/traefik/v3 >= 3.0.0, < 3.6.25, go/github.com/traefik/traefik/v3 >= 3.7.0, < 3.7.10.
vulnfeed aggregates 9207 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.