Traefik, an HTTP reverse proxy and load balancer, contains a vulnerability that allows an attacker with write access to an HTTPRoute resource to inject unescaped backticks into match values. This unsanitized input is processed by Traefik's router rule language, enabling the attacker to form arbitrary rule tokens. The result is an ability to bypass the listener hostname validation and redirect traffic destined for legitimate hostnames to attacker-controlled backends. The weakness is represented by CWE‑74 and CWE‑94.

Affected systems are deployments of the Traefik component (cpe:2.3:a:traefik:traefik) running any version prior to 3.6.10. The vulnerability is relevant in shared gateway scenarios where tenants can modify HTTPRoute definitions. It does not affect standalone servicing of the router that is not exposed to write permissions on these resources.

The CVSS score for this issue is 6.1, classified as Medium severity, while the EPSS score is less than 1 %, indicating a low probability of exploitation. It is not listed in CISA’s KEV catalog. The attack vector requires possession of Kubernetes permissions to create or modify HTTPRoute objects. An attacker can then inject backtick‑delimited tokens that cause Traefik to interpret them as rules, redirecting traffic to arbitrary destinations.