CVE-2026-32695
Traefik is an HTTP reverse proxy and load balancer.
Published Mar 27, 2026 · updated Jul 15, 2026 · traefik traefik
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 3.6.11 and 3.7.0-ea.2, Traefik's Knative provider builds router rules by interpolating user-controlled values into backtick-delimited rule expressions without escaping. In live cluster validation, Knative was exploitable for host restriction bypass (for example ) || Host( ), producing a router that serves attacker-controlled hosts. Knative also allows rule-syntax injection and proves unsafe rule construction. In multi-tenant clusters, this can route unauthorized traffic to victim services and lead to cross-tenant traffic exposure. Versions 3.6.11 and 3.7.0-ea.2 patch the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 27, 2026 · NIST NVD
Detected
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 3.6.11 and 3.7.0-ea.2, Traefik's Knative provider builds router rules by interpolating user-controlled values into backtick-delimited rule expressions without escaping. In live cluster validation, Knative was exploitable for host restriction bypass (for example ) || Host( ), producing a router that serves attacker-controlled hos
Jul 15, 2026 · NIST NVD
Updated
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 3.6.11 and 3.7.0-ea.2, Traefik's Knative provider builds router rules by interpolating user-controlled values into backtick-delimited rule expressions without escaping. In live cluster validation, Knative was exploitable for host restriction bypass (for example ) || Host( ), producing a router that serves attacker-controlled hos
Affected
- cpe traefik/traefikversion unspecified
- cpe traefik/traefik3.7.0
Sources
- CVE.orgVulnerability recordCVE-2026-32695
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-32695
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 3.6.11 and 3.7.0-ea.2, Traefik's Knative provider builds router rules by interpolating user-controlled values into backtick-delimited rule expressions without escaping. In live cluster validation, Knative `rule
nvd.nist.gov