{"items":[{"id":"NVI-00015007","kind":"vulnerability","title":"Traefik: Gateway API route identity collision allows cross-namespace backend hijacking","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-fgjj-px3w-67xx","CVE-2026-71327"],"plain_summary":"GitHub lists this reviewed advisory for github.com/traefik/traefik/v3, github.com/traefik/traefik/v3. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0165e0e4c2a0c2a614b50d0aa516089b"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-08-06T16:38:18.000Z","value":"8.2 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-069d578f3f4a3a85a25b70fc7067129f"},{"kind":"EPSS","as_of":"2026-11-03T12:00:27.000Z","value":"0.481%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.41529. Missing scores are unknown.","source_id":"sr-0165e0e4c2a0c2a614b50d0aa516089b"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-069d578f3f4a3a85a25b70fc7067129f","url":"https://github.com/advisories/GHSA-fgjj-px3w-67xx","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-fgjj-px3w-67xx","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T02:28:46.523Z"},{"id":"sr-0165e0e4c2a0c2a614b50d0aa516089b","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-71327","publisher":"FIRST EPSS","observed_at":"2026-11-03T17:45:16.078Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-069d578f3f4a3a85a25b70fc7067129f"],"technology":"github.com/traefik/traefik/v3","known_exclusions":[],"conditions_summary":"## Summary\n\nThere is a high severity vulnerability in Traefik's Kubernetes Gateway API provider. Router and service identities for `HTTPRoute`, `GRPCRoute`, `TCPRoute` and `TLSRoute` objects were built by hyphen-concatenating the route namespace, the route name, the Gateway identity, the entry point and the rule index, a construction that is not injective because Kubernetes names may themselves contain hyphens. Two distinct Routes attached to the same Gateway with equivalent match rules can therefore produce the same identity, and the Route loaded later silently overwrites the earlier one, so a tenant able to create an accepted Route in a colliding namespace/name combination can redirect another namespace's traffic to a backend it controls. All Traefik v3 minor lines are affected; the lines older than v3.6 are no longer maintained and will not receive a patch of their own, so users running them should upgrade to a maintained, patched release.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v3.6.25\n- https://github.com/traefik/traefik/releases/tag/v3.7.10\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https:","public_affected_ranges":[">= 3.0.0, < 3.6.25"]},{"certainty":"source_listed","source_ids":["sr-069d578f3f4a3a85a25b70fc7067129f"],"technology":"github.com/traefik/traefik/v3","known_exclusions":[],"conditions_summary":"## Summary\n\nThere is a high severity vulnerability in Traefik's Kubernetes Gateway API provider. Router and service identities for `HTTPRoute`, `GRPCRoute`, `TCPRoute` and `TLSRoute` objects were built by hyphen-concatenating the route namespace, the route name, the Gateway identity, the entry point and the rule index, a construction that is not injective because Kubernetes names may themselves contain hyphens. Two distinct Routes attached to the same Gateway with equivalent match rules can therefore produce the same identity, and the Route loaded later silently overwrites the earlier one, so a tenant able to create an accepted Route in a colliding namespace/name combination can redirect another namespace's traffic to a backend it controls. All Traefik v3 minor lines are affected; the lines older than v3.6 are no longer maintained and will not receive a patch of their own, so users running them should upgrade to a maintained, patched release.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v3.6.25\n- https://github.com/traefik/traefik/releases/tag/v3.7.10\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https:","public_affected_ranges":[">= 3.7.0, < 3.7.10"]}],"null_published_at":"2026-11-04T10:04:41.531Z","source_updated_at":"2026-08-06T16:38:18.000Z","source_disclosed_at":"2026-08-06T16:38:18.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-11-03T02:28:46.523Z"},{"id":"NVI-00015007","kind":"vulnerability","title":"Traefik: Gateway API route identity collision allows cross-namespace backend hijacking","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-fgjj-px3w-67xx","CVE-2026-71327"],"plain_summary":"GitHub lists this reviewed advisory for github.com/traefik/traefik/v3, github.com/traefik/traefik/v3. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-069d578f3f4a3a85a25b70fc7067129f"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-08-06T16:38:18.000Z","value":"8.2 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-069d578f3f4a3a85a25b70fc7067129f"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-069d578f3f4a3a85a25b70fc7067129f","url":"https://github.com/advisories/GHSA-fgjj-px3w-67xx","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-fgjj-px3w-67xx","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T02:28:46.523Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-069d578f3f4a3a85a25b70fc7067129f"],"technology":"github.com/traefik/traefik/v3","known_exclusions":[],"conditions_summary":"## Summary\n\nThere is a high severity vulnerability in Traefik's Kubernetes Gateway API provider. Router and service identities for `HTTPRoute`, `GRPCRoute`, `TCPRoute` and `TLSRoute` objects were built by hyphen-concatenating the route namespace, the route name, the Gateway identity, the entry point and the rule index, a construction that is not injective because Kubernetes names may themselves contain hyphens. Two distinct Routes attached to the same Gateway with equivalent match rules can therefore produce the same identity, and the Route loaded later silently overwrites the earlier one, so a tenant able to create an accepted Route in a colliding namespace/name combination can redirect another namespace's traffic to a backend it controls. All Traefik v3 minor lines are affected; the lines older than v3.6 are no longer maintained and will not receive a patch of their own, so users running them should upgrade to a maintained, patched release.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v3.6.25\n- https://github.com/traefik/traefik/releases/tag/v3.7.10\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https:","public_affected_ranges":[">= 3.0.0, < 3.6.25"]},{"certainty":"source_listed","source_ids":["sr-069d578f3f4a3a85a25b70fc7067129f"],"technology":"github.com/traefik/traefik/v3","known_exclusions":[],"conditions_summary":"## Summary\n\nThere is a high severity vulnerability in Traefik's Kubernetes Gateway API provider. Router and service identities for `HTTPRoute`, `GRPCRoute`, `TCPRoute` and `TLSRoute` objects were built by hyphen-concatenating the route namespace, the route name, the Gateway identity, the entry point and the rule index, a construction that is not injective because Kubernetes names may themselves contain hyphens. Two distinct Routes attached to the same Gateway with equivalent match rules can therefore produce the same identity, and the Route loaded later silently overwrites the earlier one, so a tenant able to create an accepted Route in a colliding namespace/name combination can redirect another namespace's traffic to a backend it controls. All Traefik v3 minor lines are affected; the lines older than v3.6 are no longer maintained and will not receive a patch of their own, so users running them should upgrade to a maintained, patched release.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v3.6.25\n- https://github.com/traefik/traefik/releases/tag/v3.7.10\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https:","public_affected_ranges":[">= 3.7.0, < 3.7.10"]}],"null_published_at":"2026-11-03T10:03:26.533Z","source_updated_at":"2026-08-06T16:38:18.000Z","source_disclosed_at":"2026-08-06T16:38:18.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-03T02:28:46.523Z"}],"next_cursor":null,"snapshot_revision":"42594"}