Route Identity Collision in Traefik Proxy Affects Multiple Versions
CVE-2026-71327
7.6HIGH
What is CVE-2026-71327?
In Traefik Proxy versions 3.0.0 to 3.6.25 and 3.7.0 to 3.7.10, a vulnerability exists within the Kubernetes Gateway API provider. This issue arises from the construction of HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute identities, where namespace, route names, Gateway identities, entry points, and rule indices are concatenated with hyphens. Such concatenation can result in route identity collisions, allowing routes from different namespaces to unintentionally overwrite backends, leading to potential service disruption. The issue has been resolved in Traefik versions 3.6.25 and 3.7.10.
Affected Version(s)
traefik >= 3.0.0, < 3.6.25 < 3.0.0, 3.6.25
traefik >= 3.7.0, < 3.7.10 < 3.7.0, 3.7.10