Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

traefik — Vulnerabilities & Security Advisories 81

All 81 CVE vulnerabilities found in traefik, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities identified in Traefik, the open-source reverse proxy and load balancer, specifically focusing on configuration weaknesses and access control flaws. The collection encompasses publicly disclosed issues ranging from early version releases to the most recent updates, covering a span of several years where critical bugs were reported and patched. Readers can utilize this resource to track the vendor's official security advisories, understand the characteristics of specific weakness classes affecting modern edge proxies, or look up the complete vulnerability history of the product to assess historical risk exposure. The data presented here serves as a centralized reference for security professionals and system administrators who need to evaluate the security posture of their infrastructure without navigating fragmented sources. By consolidating these records, the page facilitates efficient analysis of recurring patterns in the software's codebase and helps organizations prioritize remediation efforts based on the severity and impact of past incidents. This compilation ensures that stakeholders have immediate access to comprehensive information regarding known defects, enabling proactive defense strategies against potential exploitation of the reverse proxy components.

Vendor: traefik

CVE ID Title CVSS Severity Published
CVE-2026-121966 Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak CWE-488 8.7 High 2026-11-04
CVE-2026-119574 Traefik 3.2.0 before 3.7.15 FastProxy Data Race Denial of Service CWE-567 5.9 Medium 2026-10-30
CVE-2026-119572 Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider CWE-287 8.7 High 2026-10-30
CVE-2026-119573 Traefik 3.7.11 before 3.7.15 Cross-Namespace Authorization Bypass via auth-tls-secret CWE-863 4.4 Medium 2026-10-30
CVE-2026-114656 Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher CWE-436 7.5 High 2026-10-22
CVE-2026-114642 Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper CWE-295 8.7 High 2026-10-22
CVE-2026-114641 Traefik before 2.11.58 and 3.7.14 Race Condition in NTLM/Kerberos Round Tripper CWE-362 3.7 Low 2026-10-22
CVE-2026-114640 Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router CWE-290 8.7 High 2026-10-22
CVE-2026-114639 Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool CWE-287 8.7 High 2026-10-22
CVE-2026-114638 Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision CWE-287 8.7 High 2026-10-22
CVE-2026-114637 Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leak CWE-488 8.7 High 2026-10-22
CVE-2026-114636 Traefik v3.7.13 Authentication Bypass via ssl-passthrough Ingress HTTP Router CWE-306 8.7 High 2026-10-22
CVE-2026-114635 Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme CWE-288 8.7 High 2026-10-22
CVE-2026-112778 Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations CWE-862 6.4 Medium 2026-10-19
CVE-2026-88010 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle CWE-208 6.3 Medium 2026-09-22
CVE-2026-88012 Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded CWE-770 5.3 Medium 2026-09-10
CVE-2026-88011 Traefik: ForwardAuth identity spoofing via dot-form header alias CWE-290 5.3 Medium 2026-09-10
CVE-2026-88009 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging CWE-444 8.8 High 2026-09-10
CVE-2026-88008 Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization CWE-444 7.0 High 2026-09-10
CVE-2026-88007 Traefik HTTP/3 Backend NTLM Connection Reuse CWE-287 9.1 Critical 2026-09-10
CVE-2026-88004 Traefik entrypoint header-name sanitization bypassed via request trailers CWE-436 7.0 High 2026-09-10
CVE-2026-88879 Traefik before v2.11.56 Identity Spoofing via Header Alias CWE-290 5.3 Medium 2026-09-10
CVE-2026-88878 Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass CWE-770 5.3 Medium 2026-09-10
CVE-2026-88877 Traefik v3.7.0 Authentication Bypass via from-to-www-redirect CWE-639 9.8 Critical 2026-09-10
CVE-2026-85597 Traefik before v2.11.55 and v3.0.0 through v3.7.10 mTLS Bypass via TLS Option Conflict CWE-863 8.2 High 2026-09-04
CVE-2026-85596 Traefik v3.7 Authentication Bypass via TLS Option Conflict CWE-287 8.2 High 2026-09-04
CVE-2026-85595 Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth CWE-287 9.3 Critical 2026-09-04
CVE-2026-85594 Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware CWE-639 7.0 High 2026-09-04
CVE-2026-71327 Traefik: Gateway API route identity collision allows cross-namespace backend hijacking CWE-694 7.6 High 2026-08-06
CVE-2026-71326 Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing CWE-287 2.1 Low 2026-08-06

All 81 known CVE vulnerabilities affecting traefik with full Chinese analysis, references, and POCs where available.