# Traefik: Gateway API route identity collision allows cross-namespace backend hijacking

Traefik Gateway API builds route keys by hyphen-concatenating namespace and name, so team/a-app and team-a/app collide and the later Route hijacks the victim's traffic.

- Payout: Research
- Severity: high
- Program: Traefik
- Found by: hussst
- Disclosed: 2026-08-06
- CVE: CVE-2026-71327
- Write-up quality: 8/10
- Original: https://github.com/advisories/GHSA-fgjj-px3w-67xx
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-fgjj-px3w-67xx
- Tags: area:cloud domain:cloud domain:infra impact:data-leak impact:integrity kind:research platform:ghsa sev:high tech:go tech:kubernetes technique:source-review vuln:access-control vuln:misconfiguration

**Target:** Kubernetes Gateway API provider (HTTPRoute/GRPCRoute/TCPRoute/TLSRoute router and service identity)
**Root cause:** Route identity is built by hyphen-joining namespace, name, gateway identity, entrypoint and rule index, then Normalize collapses non-alphanumerics to '-', so the construction is not injective when names contain hyphens. Merging with maps.Copy silently overwrites the earlier route's routers/services on duplicate keys.
**Steps:**
1. Deploy Traefik v3.7.8 with `--providers.kubernetesgateway=true` and a shared Gateway accepting routes from All namespaces.
2. Create victim HTTPRoute `team/a-app` with hostname `collision.example`, path `/`, backend `team/backend`; confirm `curl -H 'Host: collision.example'` returns VICTIM_BACKEND.
3. Create attacker HTTPRoute `team-a/app` with identical hostname/path and backend `team-a/backend`.
4. Both normalize to key `httproute-team-a-app-gw-gateway-shared-ep-web-0`; the rule hash also matches since hostname/path are copied.
5. Re-request the same host and observe ATTACKER_BACKEND despite the victim Route having the earlier creation timestamp.
**How found:** Code review of the Gateway provider's routeKey construction: noticed the fmt.Sprintf hyphen-join plus Normalize's rune-collapsing means component boundaries are not preserved, then reasoned that hyphenated Kubernetes names allow two distinct (namespace, name) pairs to map to one key, and confirmed with a live cluster repro.
**Exploitation:** A tenant with permission to create an accepted Route in a namespace/name pair that hyphen-collides with a victim's Route copies the victim's hostname and match rules, points backendRefs at its own Service, and after Traefik merges configs all victim traffic for that host is served by the attacker backend, exposing requests, credentials and auth headers and allowing forged responses.
**Escalation:** Same collision applies to GRPCRoute, TCPRoute and TLSRoute and to derived service/middleware names, so any protocol routed through the shared Gateway can be hijacked.
**Insight:** When auditing controllers that build cache/map keys from Kubernetes object fields, check whether the key format is injective: any delimiter-joined tuple of user-controlled names (namespace, name, listener, index) is collidable if the delimiter can appear in a field. Also check whether merge uses overwrite semantics (maps.Copy) rather than conflict detection, and whether precedence rules (creation timestamp) are bypassed by the overwrite.

## Proof of concept (copied exactly from the original report)

**Colliding route key construction code**

```
routeKey := provider.Normalize(fmt.Sprintf(
	"%s-%s-%s-gw-%s-%s-ep-%s-%d",
	strings.ToLower(kindHTTPRoute),
	route.Namespace,
	route.Name,
	gatewayNamespace,
	gatewayName,
	listener.EPName,
	ri,
))
```

**maps.Copy merge overwriting duplicate keys**

```
maps.Copy(to.HTTP.Routers, from.HTTP.Routers)
maps.Copy(to.HTTP.Middlewares, from.HTTP.Middlewares)
maps.Copy(to.HTTP.Services, from.HTTP.Services)
maps.Copy(to.HTTP.ServersTransports, from.HTTP.ServersTransports)
```