CVE-2026-71327

HighCVSS 8.1/10Last modified Sep 16, 2026

Description

Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go builds HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute router and service identities by hyphen-concatenating namespace, route name, Gateway identity, entry point, and rule index, allowing colliding Routes to overwrite another namespace's backend. This issue is fixed in 3.6.25 and 3.7.10.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-694

Affected software

No affected versions have been published.

Timeline

Published
Aug 6, 2026
Last modified
Sep 16, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-713288.8Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.CVE-2026-713296.8Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code with a physical attack.CVE-2026-71334.7A vulnerability was determined in code-projects Online Lot Reservation System 1.0. This impacts an unknown function of the file /activity.phCVE-2026-713307.5Exposure of sensitive system information to an unauthorized control sphere in Windows Services for NFS ONCRPC XDR Driver allows an unauthoriCVE-2026-713318.1Integer overflow or wraparound in Windows Device Health Attestation (DHA) allows an unauthorized attacker to execute code over a network.CVE-2026-713327.0Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to elevate privileges locally.CVE-2026-713337.0Use after free in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.CVE-2026-713347.8Heap-based buffer overflow in Windows NFS Portmapper allows an authorized attacker to elevate privileges locally.CVE-2026-713368.8Integer overflow or wraparound in Windows Work Folder Service allows an authorized attacker to execute code over a network.CVE-2026-713377.8Stack-based buffer overflow in Windows Storage Management Provider allows an authorized attacker to elevate privileges locally.CVE-2026-713386.4Double free in Windows Failover Cluster allows an authorized attacker to elevate privileges locally.CVE-2026-713396.7Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-71327: High severity, CVSS 8.1 | Vulnix