Bug 2512294 (CVE-2026-71327)
| Summary: | CVE-2026-71327 github.com/traefik/traefik: Traefik: Cross-namespace backend hijacking due to Gateway API identity collision | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | anjoseph, jprabhak, sdawley, wtam |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Traefik, an open-source HTTP reverse proxy and load balancer. Its Kubernetes Gateway API provider incorrectly generates unique identifiers for routes and services. This vulnerability allows an attacker to create conflicting routes, which can then overwrite the backend services of another isolated environment (namespace). This could lead to unauthorized control over services in different namespaces.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-08-06 22:27:46 UTC
|