Homepage

Use of Multiple Resources with Duplicate Identifier Affecting traefik-3 package, versions <3.7.10-r0

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.36% (30th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-TRAEFIK3-18585332
  • published8 Aug 2026
  • disclosed6 Aug 2026
Report a new vulnerability Found a mistake?

Introduced: 6 Aug 2026

NewCVE-2026-71327  (opens in a new tab)
CWE-694  (opens in a new tab)

How to fix?

Upgrade Minimos:latest traefik-3 to version 3.7.10-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream traefik-3 package and not the traefik-3 package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go builds HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute router and service identities by hyphen-concatenating namespace, route name, Gateway identity, entry point, and rule index, allowing colliding Routes to overwrite another namespace's backend. This issue is fixed in 3.6.25 and 3.7.10.