CVE-2026-71327 is a high severity (CVSS 8.1) flaw in Traefik's Kubernetes Gateway API provider from 3.0.0 before 3.6.25 and 3.7.10. Route identities built from hyphenated names can collide, letting one namespace overwrite another's backend. The fix is Traefik 3.6.25 or 3.7.10.
What's affected
Traefik v3 from 3.0.0 until 3.6.25, and 3.7.0 until 3.7.10, using the Kubernetes Gateway API provider for HTTPRoute, GRPCRoute, TCPRoute or TLSRoute. Fixed in 3.6.25 and 3.7.10. The advisory notes that lines older than 3.6 are no longer maintained and will not get a patch of their own, so those users must upgrade to a maintained release.
The weakness is CWE-694, use of multiple resources with duplicate identifier. Router and service identities were built by joining namespace, route name, Gateway identity, entry point and rule index with hyphens. Kubernetes names can contain hyphens, so that construction is ambiguous. Two different Routes on the same Gateway with equivalent match rules can produce the same identity, and the one loaded later silently overwrites the earlier one.
Severity differs slightly by source: the record gives 8.1 and the GitHub advisory lists 8.2.
How to check if you're exposed
Check the Traefik version:
kubectl get pods -A -o jsonpath='{range .items[*]}{.spec.containers[*].image}{"\n"}{end}' | grep -i traefik
Versions in the ranges above are affected if you use the Gateway API provider. Check whether you do:
kubectl get gateways,httproutes,grpcroutes,tcproutes,tlsroutes -A
Then look for Routes that could collide: multi-tenant clusters where several teams create Routes attached to a shared Gateway. The risk is where namespaces or route names differ only in where hyphens fall.
free in-browser dependency scan and container image scanning both report the Traefik version if you scan the manifest or the image.
What to do now
- Find the Traefik version in every cluster.
- Upgrade to 3.6.25 or 3.7.10, depending on your minor line.
- Move off 3.5 and older, which will not receive a patch.
- In shared clusters, restrict which namespaces may attach Routes to a shared Gateway, using the Gateway's allowedRoutes.
- Review existing Routes for duplicate or suspicious match rules attached to shared Gateways.
Why it matters
CWE-694 is a quiet kind of bug: no crash, no error, just a later definition winning over an earlier one. The cause is an identifier built by joining strings, which is only safe when the separator cannot appear inside the parts. Kubernetes allows hyphens in names, so a, b-c and a-b, c produce the same joined text.
In a single team cluster that is a nuisance. In a multi-tenant cluster, it is an isolation failure, because a tenant who can create a Route can redirect another namespace's traffic to a backend they control.
Quick check
Do I need the Gateway API provider to be affected?
Yes. The flaw is in the Kubernetes Gateway API provider for HTTPRoute, GRPCRoute, TCPRoute and TLSRoute. Other providers are not described as affected.
Sources
Last reviewed: 18 October 2026.
