HTTP Reverse Proxy and Load Balancer Vulnerability in Traefik by Traefik Labs

CVE-2026-29777

What is CVE-2026-29777?

Traefik, a widely-used HTTP reverse proxy and load balancer, suffers from a vulnerability that allows tenants with write access to HTTPRoute resources to inject backtick-delimited rule tokens. This occurs through unsanitized header or query parameter match values. In environments where shared gateways are deployed, such an injection can bypass listener hostname restrictions, potentially redirecting traffic intended for legitimate hostnames to malicious backends, facilitating phishing or data exfiltration attacks. The issue has been resolved in version 3.6.10.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References