CVE-2026-29777

score

<0.1

cvss

6.5

epss

0.4%

published

2026-03-11

kev added

—

first seen

2026-10-21

Traefik < 3.6.10 contains a broken access control vulnerability caused by unsanitized header or query parameter match values in HTTPRoute resource, letting tenants with write access bypass hostname constraints and redirect traffic, exploit requires tenant write access.