Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1325 CNY

100%

traefik — Vulnerabilities & Security Advisories 42

All 42 CVE vulnerabilities found in traefik, with AI-generated Chinese analysis, references, and POCs.

This page documents known security weaknesses in traefik, a popular open-source reverse proxy and load balancer. The aggregate here collects reported vulnerabilities associated with this specific product, covering incidents identified from the early days of its public release through recent updates. Users can track vendor advisories to stay informed about patches and mitigation strategies, understand the broader context of weakness classes affecting web infrastructure, and look up the product’s historical vulnerability profile to assess long-term security posture. By centralizing this information, the resource aims to provide clarity for developers, system administrators, and security analysts who rely on traefik for routing and securing application traffic. The data reflects publicly disclosed issues, emphasizing patterns in design flaws, configuration errors, or implementation bugs that have been reported across various versions. This approach helps stakeholders identify recurring themes, evaluate risk exposure, and make informed decisions about upgrades or architectural changes. The scope includes diverse vulnerability types, ranging from remote code execution to denial-of-service conditions, ensuring a comprehensive view of the product’s security landscape. Readers are encouraged to use this aggregation as a reference point for auditing their deployments and aligning with best practices for vulnerability management.

Vendor: traefik

CVE IDTitleCVSSSeverityPublished
CVE-2026-54762 Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails CWE-636--2026-06-23
CVE-2026-54761 Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services CWE-284--2026-06-23
CVE-2026-53622 Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts CWE-288--2026-06-23
CVE-2026-48491 Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass CWE-288--2026-06-23
CVE-2026-48020 Traefik StripPrefix Route-Level Auth Bypass via Path Normalization CWE-288--2026-06-23
CVE-2023-54365 Traefik - Denial of Service via HTTP/2 Request Handling CWE-400 7.5 High2026-06-23
CVE-2026-44774 Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false CWE-284--2026-05-15
CVE-2026-41181 Traefik: Errors middleware forwards Authorization and Cookie headers to separate error page service CWE-201--2026-05-15
CVE-2026-41263 Traefik: BasicAuth middleware: timing side-channel vulnerability CWE-208 3.7 -2026-04-30
CVE-2026-40912 Traefik: StripPrefixRegex auth bypass via Path/RawPath desync CWE-706 8.2 -2026-04-30
CVE-2026-39858 Traefik: Forwarded alias spoofing top pre-auth decision bypass CWE-290 9.8 -2026-04-30
CVE-2026-35051 Traefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth CWE-345 9.1 -2026-04-30
CVE-2026-41174 Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding CWE-863 9.3 -2026-04-30
CVE-2026-33433 Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField CWE-290 8.1 -2026-03-27
CVE-2026-32695 Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass CWE-74 10.0 -2026-03-27
CVE-2026-32595 Traefik: BasicAuth Middleware Timing Attack Allows Username Enumeration CWE-208 3.7 -2026-03-20
CVE-2026-32305 Traefik mTLS bypass via fragmented ClientHello SNI extraction failure CWE-287 7.5 -2026-03-20
CVE-2026-29777 Traefik has a kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values CWE-74 5.4AIMediumAI2026-03-11
CVE-2026-29054 Traefik: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`) CWE-178 7.5 High2026-03-05
CVE-2026-26999 Traefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (slowloris doS) CWE-400 7.5 High2026-03-05
CVE-2026-26998 Traefik: unbounded io.ReadAll on auth server response body causes OOM denial of service(DOS) CWE-770 4.4 Medium2026-03-05
CVE-2026-25949 Traefik: TCP readTimeout bypass via STARTTLS on Postgres CWE-400 7.5 High2026-02-12
CVE-2026-22045 Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall CWE-770 5.9 Medium2026-01-15
CVE-2025-66491 Traefik has Inverted TLS Verification Logic in its ingress-nginx Provider CWE-295 5.9 Medium2025-12-09
CVE-2025-66490 Traefik doesn't Prevent Path Normalization Bypass in Router + Middleware Rules CWE-436 9.8AICriticalAI2025-12-09
CVE-2025-54386 Traefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code Execution CWE-22 9.8 -2025-08-01
CVE-2025-47952 Traefik allows path traversal using url encoding CWE-22 9.1AICriticalAI2025-05-30
CVE-2025-32431 Traefik has a possible vulnerability with the path matchers CWE-22 5.9 -2025-04-21
CVE-2024-52003 X-Forwarded-Prefix Header still allows for Open Redirect in traefik CWE-601 5.3 -2024-11-29
CVE-2024-45410 HTTP client can remove the X-Forwarded headers in Traefik CWE-345 9.8 Critical2024-09-19

All 42 known CVE vulnerabilities affecting traefik with full Chinese analysis, references, and POCs where available.