CVE-2026-32695: 
NixOS vulnerability analysis and mitigation

CVE-2026-32695 is an ingress rule injection vulnerability in Traefik's Kubernetes Knative, Ingress, and Ingress-NGINX providers that allows authenticated attackers to bypass host routing restrictions. Traefik builds router rules by interpolating user-controlled values into backtick-delimited rule expressions without escaping or validation, enabling rule syntax injection. Affected versions include all Traefik v3 releases prior to 3.6.11 and v3.7.0-ea.1, as well as Traefik v2 up to and including 2.11.42 (no v2 patch available). The vulnerability was published on March 27, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 7.7 (High) and a CVSS v4.0 base score of 6.3 (Medium) (Github Advisory, Traefik Advisory).

The root cause is improper neutralization of special elements in output used by a downstream component (CWE-74). Traefik's Knative provider uses fmt.Sprintf with backtick-delimited literals to construct router rule strings — for example, fmt.Sprintf("Host(%v)", host) and fmt.Sprintf("Header(%s,%s)", key, headers[key].Exact) — without sanitizing or escaping user-supplied input. An attacker who can create or modify Knative Ingress resources can inject a backtick into fields such as rules[].hosts[] or headers[].exact to terminate the backtick literal and append arbitrary Traefik rule operators (e.g., tenant.example.com\) || Host(`attacker.com), resulting in a router that matches attacker-controlled hostnames. The Gateway API code path already uses safer %q` formatting and is not affected; standard Kubernetes Ingress host fields are typically protected by DNS-1123 API server validation, making Knative CRDs the primary exploitable vector. A self-contained Go PoC and cluster-level YAML manifests demonstrating the bypass are included in the official advisory (Traefik Advisory, Github Advisory).

Successful exploitation allows an authenticated attacker to alter Traefik's routing logic, bypassing intended host and header restrictions and redirecting unauthorized traffic to victim services. The primary risk is cross-tenant traffic exposure in multi-tenant Kubernetes clusters, where one tenant can route requests destined for another tenant's services to attacker-controlled backends, leading to confidentiality breaches of sensitive inter-service traffic. There is no direct integrity or availability impact to the Traefik system itself, but the routing bypass can be chained with application-level vulnerabilities for further lateral movement within the cluster (Traefik Advisory, Github Advisory).

A proof-of-concept exploit is publicly available in the official Traefik security advisory, including both a self-contained Go program and cluster-level YAML manifests that were validated against a live kind cluster running Traefik v3.6.10 with Knative Serving CRDs. Feedly threat intelligence classifies the PoC confidence as high, noting that the advisory provides concrete, reproducible attack steps. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.015–0.018%, indicating low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog (Github Advisory, Traefik Advisory).

1. Identify target: Confirm the target Kubernetes cluster uses Traefik (version < 3.6.11 or v3.7.0-ea.1) with the Knative provider enabled and that you have permissions to create or modify Knative Ingress resources in at least one namespace.
2. Craft malicious Knative Ingress manifest: Prepare a YAML manifest for a networking.internal.knative.dev/v1alpha1 Ingress resource with a malicious host value in spec.rules[].hosts[], such as 'tenant.example.com\) || Host(`attacker.com', and annotate it with networking.knative.dev/ingress.class: "traefik.ingress.networking.knative.dev"`.
3. Apply the manifest: Run kubectl apply -f malicious-ingress.yaml in the target namespace. Because Knative CRD schema types hosts[] as a plain string with no pattern constraint, the API server accepts the backtick-containing value without rejection.
4. Verify rule injection: Inspect the Traefik router rules via the Traefik API, dashboard, or logs. Confirm the generated rule contains the injected expression, e.g., (Host(\tenant.example.com`) || Host(`attacker.com`)) && PathPrefix(`/`)`.
5. Send bypass request: Issue an HTTP request with the Host: attacker.com header to the Traefik ingress endpoint. Observe that the backend returns HTTP 200, confirming the host restriction bypass and unauthorized routing to the victim service.
6. Alternative — header injection: Use the headers[].exact field with a payload such as x\) || Host(`attacker.comto inject rule syntax via header matching, producing a router rule likeHeader(`X-Poc`,`x`) || Host(`attacker.com`)` (Traefik Advisory, Github Advisory).

• Kubernetes API Audit Logs: kubectl or API server audit entries showing creation or update of Ingress resources (kind: networking.internal.knative.dev/v1alpha1) with spec.rules[].hosts[] or headers[].exact values containing backtick characters (`), parentheses, or the string || Host(.
• Traefik Router Rules: Traefik API (/api/http/routers) or dashboard showing router rules containing unexpected || Host(...) clauses or injected operators not matching the intended Knative Ingress configuration.
• Traefik Access Logs: HTTP requests with Host header values matching attacker-controlled domains (e.g., attacker.com) returning HTTP 200 responses from backends that should not be accessible from those hosts.
• Traefik Debug/Info Logs: Log entries indicating dynamic configuration updates from the Knative provider that include rule strings with backtick-terminated literals or unexpected logical operators.
• Network: Unexpected outbound or cross-namespace traffic flows originating from services that should only be reachable by specific tenants, observable via network policy logs or service mesh telemetry (Traefik Advisory).

Upgrade Traefik to version 3.6.11 or 3.7.0-ea.2, which patch the unsafe fmt.Sprintf rule construction by properly escaping or validating user-supplied values before interpolation into rule expressions (Traefik v3.6.11 Release, Traefik v3.7.0-ea.2 Release). No patch is currently available for Traefik v2 (≤ 2.11.42); users on v2 should migrate to a patched v3 release. As an interim workaround in multi-tenant environments, restrict RBAC permissions so that only fully trusted operators can create or modify Knative Ingress resources, and consider deploying admission webhooks or OPA/Gatekeeper policies to reject Knative Ingress manifests containing backtick characters in host or header fields (Github Advisory).

Traefik maintainer nmengin published the advisory and the Traefik community forum posted a security update announcement covering this and two other CVEs fixed in the same release (Traefik Community). The vulnerability was credited to researcher b-hermes. OpenSUSE issued security advisories for updated Traefik packages, and the issue was picked up by Linux security news aggregators (OpenSUSE Advisory). No significant broader media coverage or notable social media controversy has been observed.