High [CVE-2026-71327] Cross-namespace backend hijacking due to Gateway API identity collision
This high-severity Red Hat Linux advisory covers CVE-2026-71327 affecting Red Hat OpenShift Dev Spaces.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Traefik is an open source HTTP reverse proxy and load balancer.
From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go builds HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute router and service identities by hyphen-concatenating namespace, route name, Gateway identity, entry point, and rule index, allowing colliding Routes to overwrite another namespace's backend.
This issue is fixed in 3.6.25 and 3.7.10. Its Kubernetes Gateway API provider incorrectly generates unique identifiers for routes and services.
This vulnerability allows an attacker to create conflicting routes, which can then overwrite the backend services of another isolated environment (namespace). This could lead to unauthorized control over services in different namespaces.
A flaw in Traefik's Kubernetes Gateway API provider allows a lower-privileged tenant to overwrite backend routing rules across namespace boundaries. Due to deterministic route identity generation concatenating namespace, route name, Gateway identity, entry point, and rule index using hyphens, identical generated string identifiers result in name collisions.
Affected product named by the advisory: Red Hat OpenShift Dev Spaces.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
- 3.6.25
- 3.7.10
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Mitigation checklist
- To mitigate this flaw, restrict RBAC permissions to prevent untrusted tenants from creating or modifying Kubernetes Gateway API route resources (HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute). Alternatively, deploy isolated Traefik ingress controller instances with single-namespace scope enforcement.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.