Traefik, an open source HTTP reverse proxy, suffered a route identity collision bug in its Kubernetes Gateway API provider. By concatenating the namespace, route name, Gateway identity, entry point, and rule index, the software could generate identical router and service identities for routes in different namespaces. This flaw allowed a malicious or misconfigured route to overwrite the backend of a route in another namespace, effectively hijacking traffic and circumventing namespace isolation. The vulnerability is a classic access control weakness, identified as CWE‑694, and can lead to unauthorized access to services and data stored in target namespaces.

The affected product is Traefik. Versions 3.0.0 through 3.6.24 and 3.7.0 through 3.7.9 are impacted, while the issue is fixed in Traefik 3.6.25 and 3.7.10. Administrators of Kubernetes clusters using Traefik should verify the SHA‑256 of the binary or release tag to confirm an unaffected version.

The CVSS score is 7.6, indicating a moderate to high severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be internal: an attacker who can create or modify Kubernetes Route objects with sufficient API permissions can trigger the collision and hijack backends. Because the flaw depends on the presence of identical identities across namespaces, the attack does not require elevated cluster‑wide privileges, only the ability to affect the Gateway API routes in the victim namespace.