CVE-2026-32695
Description
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 3.6.11 and 3.7.0-ea.2, Traefik's Knative provider builds router rules by interpolating user-controlled values into backtick-delimited rule expressions without escaping. In live cluster validation, Knative `rules[].hosts[]` was exploitable for host restriction bypass (for example `tenant.example.com`) || Host(`attacker.com`), producing a router that serves attacker-controlled hosts. Knative `headers[].exact` also allows rule-syntax injection and proves unsafe rule construction. In multi-tenant clusters, this can route unauthorized traffic to victim services and lead to cross-tenant traffic exposure. Versions 3.6.11 and 3.7.0-ea.2 patch the issue.
How to fix
- traefik traefik3.6.11 or later
- github.com/traefik/traefik/v33.6.11, 3.7.0-ea.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| traefik traefik | v < 3.6.11, 3.7.0 | 3.6.11 |
| github.com/traefik/traefik/v3Go | v < 3.6.11, 3.7.0-ea.1 ≤ v < 3.7.0-ea.2 | 3.6.11, 3.7.0-ea.2 |
| github.com/traefik/traefik/v2Go | v ≤ 2.11.42, No range specified | — |
| github.com/traefik/traefikGo | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.