Traefik HTTPRoute Rule Injection Vulnerability in Kubernetes Gateway

A rule injection vulnerability has been identified in Traefik's Kubernetes Gateway provider, affecting versions through 3.6.9. A tenant with write access to an HTTPRoute resource can inject backtick-delimited rule tokens into Traefik's router rule language. This is possible via unsanitized header or query parameter match values. In shared gateway deployments, the vulnerability can bypass listener hostname constraints, redirecting traffic for victim hostnames to attacker-controlled backends.

Impact

Exploitation of this vulnerability could lead to unauthorized rule injection, allowing attackers to manipulate routing behaviors and redirect traffic to malicious backends.

Remediation

Users can upgrade to Traefik version 3.6.10 to address this vulnerability.