CVE-2026-29777: Traefik

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.10, A tenant with write access to an HTTPRoute resource can inject backtick-delimited rule tokens into Traefik's router rule language via unsanitized header or query parameter match values. In shared gateway deployments, this can bypass listener hostname constraints and redirect traffic for victim hostnames to attacker-controlled backends. This vulnerability is fixed in 3.6.10.

Affected products

• Traefik Traefik: before 3.6.10 (fixed in 3.6.10)

Published 2026-03-11. Last modified 2026-06-17.