Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

traefik — Vulnerabilities & Security Advisories 81

All 81 CVE vulnerabilities found in traefik, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities identified in Traefik, the open-source reverse proxy and load balancer, specifically focusing on configuration weaknesses and access control flaws. The collection encompasses publicly disclosed issues ranging from early version releases to the most recent updates, covering a span of several years where critical bugs were reported and patched. Readers can utilize this resource to track the vendor's official security advisories, understand the characteristics of specific weakness classes affecting modern edge proxies, or look up the complete vulnerability history of the product to assess historical risk exposure. The data presented here serves as a centralized reference for security professionals and system administrators who need to evaluate the security posture of their infrastructure without navigating fragmented sources. By consolidating these records, the page facilitates efficient analysis of recurring patterns in the software's codebase and helps organizations prioritize remediation efforts based on the severity and impact of past incidents. This compilation ensures that stakeholders have immediate access to comprehensive information regarding known defects, enabling proactive defense strategies against potential exploitation of the reverse proxy components.

Vendor: traefik

CVE ID Title CVSS Severity Published
CVE-2026-71325 Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef CWE-653 4.8 Medium 2026-08-06
CVE-2026-71324 Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool CWE-444 7.0 High 2026-08-06
CVE-2026-67309 Traefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypass CWE-22 7.8 High 2026-08-01
CVE-2026-65602 Traefik before 3.6.23 IngressRouteTCP ServersTransport Namespace Bypass CWE-863 5.3 Medium 2026-07-22
CVE-2026-65600 Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex CWE-22 7.8 High 2026-07-22
CVE-2026-65601 Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef CWE-863 5.3 Medium 2026-07-22
CVE-2026-54763 Traefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth CWE-178 - - 2026-07-06
CVE-2026-54765 Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port CWE-284 - - 2026-07-06
CVE-2026-54764 ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false CWE-345 - - 2026-07-06
CVE-2026-54762 Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails CWE-636 - - 2026-06-23
CVE-2026-54761 Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services CWE-284 - - 2026-06-23
CVE-2026-53622 Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts CWE-288 7.8 High 2026-06-23
CVE-2026-48491 Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass CWE-288 7.8 High 2026-06-23
CVE-2026-48020 Traefik StripPrefix Route-Level Auth Bypass via Path Normalization CWE-288 7.8 High 2026-06-23
CVE-2023-54365 Traefik - Denial of Service via HTTP/2 Request Handling CWE-400 7.5 High 2026-06-23
CVE-2026-44774 Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false CWE-284 6.4 Medium 2026-05-15
CVE-2026-41181 Traefik: Errors middleware forwards Authorization and Cookie headers to separate error page service CWE-201 - - 2026-05-15
CVE-2026-41263 Traefik: BasicAuth middleware: timing side-channel vulnerability CWE-208 3.7 - 2026-04-30
CVE-2026-40912 Traefik: StripPrefixRegex auth bypass via Path/RawPath desync CWE-706 8.2 - 2026-04-30
CVE-2026-39858 Traefik: Forwarded alias spoofing top pre-auth decision bypass CWE-290 9.8 - 2026-04-30
CVE-2026-35051 Traefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth CWE-345 9.1 - 2026-04-30
CVE-2026-41174 Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding CWE-863 9.3 - 2026-04-30
CVE-2026-33433 Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField CWE-290 8.1 - 2026-03-27
CVE-2026-32695 Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass CWE-74 10.0 - 2026-03-27
CVE-2026-32595 Traefik: BasicAuth Middleware Timing Attack Allows Username Enumeration CWE-208 3.7 - 2026-03-20
CVE-2026-32305 Traefik mTLS bypass via fragmented ClientHello SNI extraction failure CWE-287 7.5 - 2026-03-20
CVE-2026-29777 Traefik has a kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values CWE-74 5.4AI Medium AI 2026-03-11
CVE-2026-29054 Traefik: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`) CWE-178 7.5 High 2026-03-05
CVE-2026-26999 Traefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (slowloris doS) CWE-400 7.5 High 2026-03-05
CVE-2026-26998 Traefik: unbounded io.ReadAll on auth server response body causes OOM denial of service(DOS) CWE-770 4.4 Medium 2026-03-05

All 81 known CVE vulnerabilities affecting traefik with full Chinese analysis, references, and POCs where available.