Traefik’s Knative provider interpolates user‑controlled values into backtick‑delimited rule expressions without escaping, allowing syntax injection in the hosts field. An attacker can supply an entry such as tenant.example.com || Host(`attacker.com`), resulting in a router that serves attacker‑controlled hosts. This bypasses host restriction and permits unauthorized traffic to reach victim services, exposing sensitive data across tenants.

Traefik v3.6.x earlier than 3.6.11 and v3.7.0-ea.1 or earlier are affected. The vulnerability exists in the Knative provider component of Traefik.

The CVSS score of 6.3 classifies the issue as medium severity. An EPSS score below 1% indicates a low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The attack vector is inferred as remote, via HTTP traffic configured through the Knative provider; exploitation requires an attacker to supply a malicious hosts entry in a Knative rule set.