CVE-2026-71327

Katalog CVE

CVSS 8.1 · High EPSS 0,48%

Kerentanan Use of Multiple Resources with Duplicate Identifier pada traefik. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go builds HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute router and service identities by hyphen-concatenating namespace, route name, Gateway identity, entry point, and rule index, allowing colliding Routes to overwrite another namespace's backend. This issue is fixed in 3.6.25 and 3.7.10.

Rincian

Terbit di NVD

6 Agustus 2026

Terakhir diubah

16 September 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-694: Use of Multiple Resources with Duplicate Identifier

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/traefik/traefik/security/advisories/GHSA-fgjj-px3w-67xx patch · advisory vendor
• https://github.com/traefik/traefik/commit/a764166656f0cd337f917ac76315c381cca844f9 patch
• https://github.com/traefik/traefik/pull/13580 issue tracking · patch
• https://github.com/traefik/traefik/releases/tag/v3.6.25 patch · release notes
• https://github.com/traefik/traefik/releases/tag/v3.7.10 patch · release notes