CVE-2026-29777

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-29777
Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.10, A tenant with write access to an HTTPRoute resource can inject backtick-delimited rule tokens into Traefik's router rule language via unsanitized header or query parameter match values. In shared gateway deployments, this can bypass listener hostname constraints and redirect traffic for victim hostnames to attacker-controlled backends. This vulnerability is fixed in 3.6.10.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/traefik/traefik/releases/tag/v3.6.10 Release Notes
https://github.com/traefik/traefik/security/advisories/GHSA-8q2w-wr49-whqj Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*
History

19 Mar 2026, 20:26

Type Values Removed Values Added
Summary
  • (es) Traefik es un proxy inverso HTTP y un balanceador de carga. Antes de la versión 3.6.10, un inquilino con acceso de escritura a un recurso HTTPRoute puede inyectar tokens de reglas delimitados por comillas invertidas en el lenguaje de reglas del router de Traefik a través de valores de coincidencia de encabezado o parámetro de consulta no saneados. En implementaciones de pasarela compartida, esto puede eludir las restricciones de nombre de host del oyente y redirigir el tráfico para nombres de host de víctimas a backends controlados por el atacante. Esta vulnerabilidad se corrige en la versión 3.6.10.
References () https://github.com/traefik/traefik/releases/tag/v3.6.10 - () https://github.com/traefik/traefik/releases/tag/v3.6.10 - Release Notes
References () https://github.com/traefik/traefik/security/advisories/GHSA-8q2w-wr49-whqj - () https://github.com/traefik/traefik/security/advisories/GHSA-8q2w-wr49-whqj - Vendor Advisory
First Time Traefik
Traefik traefik
CPE cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5

11 Mar 2026, 16:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-11 16:16

Updated : 2026-03-19 20:26

NVD link : CVE-2026-29777

Mitre link : CVE-2026-29777

CVE.ORG link : CVE-2026-29777

JSON object : View

Products Affected

traefik

  • traefik
CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')