Which versions of Traefik are affected by CVE-2026-32695?

Organizations using Traefik should be aware of moderate risk from CVE-2026-32695, a injection vulnerability rated CVSS 6.3.. A patch is available.

How to fix or mitigate CVE-2026-32695?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Traefik CVE-2026-32695

Q: What is the CVSS score of CVE-2026-32695?

CVE-2026-32695 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16606 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-03-27 GitHub_M

Authentication Bypass Traefik

6.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

MEDIUM

qualitative

Red Hat

7.7 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 27, 2026 - 14:00 euvd

EUVD-2026-16606

Analysis Generated

Mar 27, 2026 - 14:00 vuln.today

CVE Published

Mar 27, 2026 - 13:47 nvd

MEDIUM 6.3

DescriptionCVE.org

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 3.6.11 and 3.7.0-ea.2, Traefik's Knative provider builds router rules by interpolating user-controlled values into backtick-delimited rule expressions without escaping. In live cluster validation, Knative rules[].hosts[] was exploitable for host restriction bypass (for example tenant.example.com) || Host(attacker.com), producing a router that serves attacker-controlled hosts. Knative headers[].exact also allows rule-syntax injection and proves unsafe rule construction. In multi-tenant clusters, this can route unauthorized traffic to victim services and lead to cross-tenant traffic exposure. Versions 3.6.11 and 3.7.0-ea.2 patch the issue.

AnalysisAI

Traefik's Knative provider fails to escape user-controlled values when interpolating host and header rules into backtick-delimited expressions, allowing attackers to inject rule syntax and bypass host restrictions in multi-tenant clusters. Versions prior to 3.6.11 and 3.7.0-ea.2 are affected. An attacker can craft malicious Knative ingress configurations to route traffic intended for one tenant to attacker-controlled hosts, enabling unauthorized cross-tenant traffic exposure and service impersonation.

Technical ContextAI

Traefik (cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*) is an HTTP reverse proxy and load balancer that supports Kubernetes Knative ingress controllers. The vulnerability stems from improper input validation classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The Knative provider dynamically constructs router rules by directly interpolating user-supplied values (from rules[].hosts[] and headers[].exact fields) into backtick-delimited rule expressions without sanitization or escaping. These expressions use Traefik's rule syntax, which supports logical operators like || and function calls like Host(). An attacker controlling Knative resource definitions can inject syntax such as || Host(attacker.com) to expand the match criteria and bypass intended routing policies.

RemediationAI

Upgrade Traefik immediately to version 3.6.11 or later (for 3.6.x users) or version 3.7.0-ea.2 or later (for 3.7.x users). For users unable to patch immediately, restrict Knative ingress resource creation and modification via Kubernetes RBAC to only trusted administrator accounts, and audit existing Knative ingress definitions for suspicious rule syntax in rules[].hosts[] and headers[].exact fields. Additionally, implement network policies to isolate tenant traffic at the pod level and monitor Traefik routing decisions for unexpected cross-tenant traffic patterns. See https://github.com/traefik/traefik/security/advisories/GHSA-67jx-r9pv-98rj for complete remediation guidance.