CVE-2026-32695

traefik

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2026-32695

Katalog CVE

CVSS 7.7 · High EPSS 0,53%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada traefik. Skor CVSS 3.1 7.7 (High) menurut NVD.

Deskripsi (NVD)

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 3.6.11 and 3.7.0-ea.2, Traefik's Knative provider builds router rules by interpolating user-controlled values into backtick-delimited rule expressions without escaping. In live cluster validation, Knative `rules[].hosts[]` was exploitable for host restriction bypass (for example `tenant.example.com`) || Host(`attacker.com`), producing a router that serves attacker-controlled hosts. Knative `headers[].exact` also allows rule-syntax injection and proves unsafe rule construction. In multi-tenant clusters, this can route unauthorized traffic to victim services and lead to cross-tenant traffic exposure. Versions 3.6.11 and 3.7.0-ea.2 patch the issue.

Rincian

Terbit di NVD
27 Maret 2026
Terakhir diubah
15 Juli 2026
Status NVD
Modified
CVSS 3.1
7.7 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
EPSS (30 hari)
0,53% peluang dieksploitasi; lebih tinggi dari 43,4% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
traefik traefik Semua versi sebelum 3.6.11
traefik traefik Versi 3.7.0 ea1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.