CVE-2026-29777: 
NixOS vulnerability analysis and mitigation

CVE-2026-29777 is a rule injection vulnerability in Traefik's Kubernetes Gateway provider, described as "Kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values." A tenant with write access to an HTTPRoute resource can inject backtick-delimited rule tokens into Traefik's router rule language via unsanitized header or query parameter match values, enabling traffic hijacking in shared gateway deployments. It affects all Traefik versions up to and including v3.6.9 (including v1.x and v2.x branches), with a fix available in v3.6.10. The vulnerability was disclosed on March 11, 2026, and carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 6.1 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-94 (Code Injection). Traefik's Kubernetes Gateway provider constructs router rule strings by interpolating HTTPRoute match values directly into backtick-delimited string literals using fmt.Sprintf("Header(%s,%s)", header.Name, header.Value) and fmt.Sprintf("Query(%s,%s)", qp.Name, qp.Value) without any escaping or validation. Because the backtick character is a string delimiter in Traefik's rule language, an attacker-controlled value containing a backtick can terminate the literal and inject additional rule tokens — for example, `) || HostRegexp(`.*`) || — changing the parsed AST root from AND to OR and bypassing the intended Host(...) constraint. The affected code resides in pkg/provider/kubernetes/gateway/httproute.go (functions buildHeaderRules and buildQueryParamRules), pkg/provider/kubernetes/gateway/grpcroute.go (buildGRPCHeaderRules), and pkg/provider/kubernetes/knative/kubernetes.go (buildRule); the injected rule is then parsed by pkg/muxer/http/parser.go (GitHub Advisory).

In shared Kubernetes gateway deployments where multiple tenants share the same Traefik gateway instance, a malicious tenant can bypass listener hostname constraints that are intended to isolate tenant traffic. This allows requests destined for victim hostnames to be silently redirected to attacker-controlled backends, enabling traffic hijacking, credential/token capture, and request forgery. Traefik's own documentation positions Gateway API listener constraints as a multi-tenant security boundary, so this vulnerability directly undermines that security model; availability is not impacted, but confidentiality of downstream systems is rated High under CVSS v4.0 (GitHub Advisory, Feedly).

There is no evidence of active in-the-wild exploitation or a publicly available weaponized exploit at this time. A proof-of-concept (poc.zip) was included by the reporter (Oleh Konko, credited as "1seal") in the advisory submission, demonstrating end-to-end routing hijack in a Kubernetes environment, but it has not been publicly released as a standalone tool. The EPSS score is approximately 0.017% (5th percentile), indicating low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Obtain HTTPRoute write access: Gain or already possess write access to an HTTPRoute resource in a tenant namespace within a shared Kubernetes cluster running a vulnerable Traefik version (≤ v3.6.9) as the gateway.
2. Craft a malicious HTTPRoute: Create or modify an HTTPRoute resource with a header or query parameter match value containing a backtick-based injection payload. For example, set a header match value to: somevalue`) || HostRegexp(`.*`) || Header(`x-dummy`,`x to inject an OR branch into the generated rule.
3. Apply the HTTPRoute: Submit the malicious HTTPRoute manifest to the Kubernetes API server (kubectl apply -f malicious-httproute.yaml). Traefik's gateway provider will process the resource and build a router rule string without escaping the injected backtick.
4. Trigger rule injection: Traefik's rule parser (pkg/muxer/http/parser.go) evaluates the injected rule, changing the AST root from AND to OR. The HostRegexp(.*) branch now matches all hostnames, including victim hostnames not assigned to the attacker's listener.
5. Capture victim traffic: Send HTTP requests to the victim hostname through the shared gateway. Due to the injected OR branch bypassing the Host(...) constraint, Traefik routes the traffic to the attacker-controlled backend, enabling credential capture, session token theft, or request forgery (GitHub Advisory).

• Kubernetes API Audit Logs: Unexpected CREATE or UPDATE events on HTTPRoute resources in tenant namespaces, particularly from service accounts not typically managing routing configuration; payloads containing backtick characters (`) in spec.rules[].matches[].headers[].value or spec.rules[].matches[].queryParams[].value fields.
• Traefik Logs: Unusual router rule strings in Traefik debug logs containing ||, HostRegexp, or other injected operators alongside backtick characters; unexpected routing of requests for known victim hostnames to backends registered under a different tenant.
• Network: HTTP requests to victim hostnames being served responses from unexpected backend services or IP addresses; anomalous cross-tenant traffic patterns at the gateway layer.
• File System / Configuration: HTTPRoute manifests in tenant namespaces containing header or query parameter match values with embedded backtick characters or Traefik rule-language keywords (HostRegexp, PathPrefix, ||, etc.) (GitHub Advisory).

Upgrade Traefik to v3.6.10, which fixes this vulnerability by implementing injection-safe quoting for rule arguments (e.g., using fmt.Sprintf("Header(%q,%q)", name, value)) (Traefik Release). Note that v1.x and v2.x branches (up to v2.11.40) are also listed as affected but have no patched version published; organizations using those branches should prioritize migration to v3.6.10 or later. As an interim workaround, implement strict Kubernetes RBAC to limit which service accounts and users can create or modify HTTPRoute resources in tenant namespaces, and consider isolating gateway instances per tenant to eliminate the shared-gateway attack surface (GitHub Advisory, Feedly).

Traefik maintainer nmengin published the official security advisory on March 11, 2026, and the fix was included in the v3.6.10 release (Traefik Release). The Traefik community forum posted a security update announcement covering both v2.11 and v3.6 branches (Traefik Community). Red Hat tracked the issue via Bugzilla (Bug 2446584) with medium severity, and openSUSE issued a security announcement for the affected package (Red Hat Bugzilla). The vulnerability was also picked up by GitLab's advisory database and Tenable's Nessus plugin (ID 318669), indicating broad scanner coverage.