Traefik CVE-2026-29777
GHSA-8q2w-wr49-whqj
Lifecycle Timeline
3DescriptionCVE.org
Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.10, A tenant with write access to an HTTPRoute resource can inject backtick-delimited rule tokens into Traefik's router rule language via unsanitized header or query parameter match values. In shared gateway deployments, this can bypass listener hostname constraints and redirect traffic for victim hostnames to attacker-controlled backends. This vulnerability is fixed in 3.6.10.
AnalysisAI
Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.10, A tenant with write access to an HTTPRoute resource can inject backtick-delimited rule tokens into Traefik's router rule language via unsanitized header or query parameter match values. In shared gateway deployments, this can bypass listener hostname constraints and redirect traffic for victim hostnames to attacker-controlled ...
Technical ContextAI
exists in the unsanitized header or query component. Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.10, A tenant with write access to an HTTPRoute resource can inject backtick-delimited rule tokens into Traefik's router rule language via unsanitized header or query parameter match values. In shared gateway deployments, this can bypass listener hostname constraints and redirect traffic for victim hostnames to attacker-controlled backends. This vulnerability is fixed in 3.6.10.
Affected ProductsAI
Product: Traefik is an HTTP reverse proxy and load balancer.. Versions: up to 3.6.10. Component: unsanitized header or query.
RemediationAI
Fixed in version 3.6.10..
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today