GitHub Security Advisory: GHSA-67jx-r9pv-98rj
Package: github.com/traefik/traefik/v3 (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: < 3.6.11
Patched in: 3.6.11

Summary: Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass

Details:
## Summary

There is a potential vulnerability in Traefik's Kubernetes Knative, Ingress, and Ingress-NGINX providers related to rule injection.

User-controlled values are interpolated into backtick-delimited Traefik router rule expressions without escaping or validation. A malicious value containing a backtick can terminate the literal and inject additional operators into Traefik's rule language, altering the parsed rule tree. In shared or multi-tenant deployments, this can bypass host and header routing constraints and redirect unauthorized traffic to victim services.

## Patches

- https://github.com/traefik/traefik/releases/tag/v3.6.11
- https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.2

## For more information

If there are any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

<details>
<summary>Original Description</summary>

### Summary
Traefik's Knative provider builds router rules by interpolating user-controlled values into backtick-delimited rule expressions without escaping. In live cluster validation, Knative `rules[].hosts[]` was exploitable for host restriction bypass (for example `tenant.example.com`) || Host(`attacker.com`), producing a router that serves attacker-controlled hosts. Knative `headers[].exact` also allows rule-syntax injection and proves unsafe rule construction. In multi-tenant clusters, this can route unauthorized traffic to victim services and lead to cross-tenant traffic exposure. Severity is High in shared deployments.

Tested on Traefik `v3.6.10`; the vulnerable pattern appears to have been present since the Knative provider was introduced. Earlier versions with Knative provider support are expected to be affected.

### Details
The issue is caused by unsafe rule-string construction using `fmt.Sprintf` with backtick-delimited literals.

Incriminated code patterns:

- `pkg/provider/kubernetes/knative/kubernetes.go`
  - `fmt.Sprintf("Host(`%v`)", host)`
  - `fmt.Sprintf("Header(`%s`,`%s`)", key, headers[key].Exact)`
  - `fmt.Sprintf("PathPrefix(`%s`)", path)`

- `pkg/provider/kubernetes/ingress/kubernetes.go`
  - `fmt.Sprintf("Host(`%s`)", host)`
  - `fmt.Sprintf("(Path(`%[1]s`) || PathPrefix(`%[1]s/`))", path)`

- `pkg/provider/kubernetes/ingress-nginx/kubernetes.go` (hardening candidate; not the primary confirmed vector in this report)
  - `fmt.Sprintf("Header(`%s`, `%s`)", c.Header, c.HeaderValue)`
  - related host/path/header concatenations with backticks

Because inputs are inserted directly into rule expressions, a malicious value containing a backtick can terminate the literal and inject additional operators/tokens in Traefik's rule language. Example payload:

- `x`) || Host(`attacker.com`

When used as a header value in Knative rule construction, the resulting rule contains:

- `Header(`X-Poc`,`x`) || Host(`attacker.com`)`

This alters rule semantics and enables injection into Traefik's rule language. Depending on the field used (`host