Veille CVE
CVE-2026-71327
8.1 ÉlevéeDescription
Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go builds HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute router and service identities by hyphen-concatenating namespace, route name, Gateway identity, entry point, and rule index, allowing colliding Routes to overwrite another namespace's backend. This issue is fixed in 3.6.25 and 3.7.10.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 4.0 | 7.6 Élevée | security-advisories@github.com | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| 3.1 | 8.1 Élevée | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Faiblesses (CWE)
Références
- https://github.com/traefik/traefik/commit/a764166656f0cd337f917ac76315c381cca844f9 Patch
- https://github.com/traefik/traefik/pull/13580 Issue TrackingPatch
- https://github.com/traefik/traefik/releases/tag/v3.6.25 PatchRelease Notes
- https://github.com/traefik/traefik/releases/tag/v3.7.10 PatchRelease Notes
- https://github.com/traefik/traefik/security/advisories/GHSA-fgjj-px3w-67xx PatchVendor Advisory