Latest vulnerabilities for "traefik traefik"

Where

Sort:

Versions

3.0.0

Traefik traefikTraefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false

Risk 82

Severity

6.4

First published (updated )

CVE-2026-44774

Traefik traefikTraefik: Errors middleware forwards Authorization and Cookie headers to separate error page service

Risk 33

Severity

6.9

First published (updated )

CVE-2026-41181

Traefik traefikTraefik: BasicAuth middleware: timing side-channel vulnerability

Risk 30

Severity

6.3

First published (updated )

CVE-2026-41263

Traefik traefikTraefik Kubernetes CRD allows unauthorized cross-namespace middleware binding

Risk 39

Severity

4.8

First published (updated )

CVE-2026-41174

Traefik traefikTraefik: StripPrefixRegex auth bypass via Path/RawPath desync

Risk 54

Severity

7.8

First published (updated )

CVE-2026-40912

Traefik traefikTraefik: Forwarded alias spoofing top pre-auth decision bypass

Risk 73

Severity

7.8

First published (updated )

CVE-2026-39858

Traefik traefikTraefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth

Risk 73

Severity

7.8

First published (updated )

CVE-2026-35051

Traefik traefikTraefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField

Risk 79

Severity

5.1

First published (updated )

CVE-2026-33433

Traefik traefikTraefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass

Risk 44

Severity

6.3

First published (updated )

CVE-2026-32695

Traefik traefikTraefik: BasicAuth Middleware Timing Attack Allows Username Enumeration

Risk 21

Severity

6.3

EPSS

0.01%

First published (updated )

CVE-2026-32595

Traefik traefikTraefik mTLS bypass via fragmented ClientHello SNI extraction failure

Risk 46

Severity

7.8

EPSS

0.05%

First published (updated )

CVE-2026-32305

go/github.com/traefik/traefik/v3Traefik has a kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values

Risk 27

Severity

6.1

EPSS

0.01%

First published (updated )

CVE-2026-29777

Traefik traefikTraefik: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`)

Risk 31

Severity

7.5

EPSS

0.01%

First published (updated )

CVE-2026-29054

Traefik traefikTraefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (slowloris doS)

Risk 43

Severity

7.5

First published (updated )

CVE-2026-26999

Traefik traefikTraefik: unbounded io.ReadAll on auth server response body causes OOM denial of service(DOS)

Risk 26

Severity

4.4

First published (updated )

CVE-2026-26998

go/github.com/traefik/traefik/v3Traefik: TCP readTimeout bypass via STARTTLS on Postgres

Risk 31

Severity

7.5

EPSS

0.02%

First published (updated )

CVE-2026-25949

Traefik traefikTraefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall

Risk 31

Severity

7.5

EPSS

0.02%

First published (updated )

CVE-2026-22045

go/github.com/traefik/traefik/v3Traefik has Inverted TLS Verification Logic in its ingress-nginx Provider

Risk 35

Severity

5.9

First published (updated )

CVE-2025-66491

Traefik Traefik GoTraefik doesn't Prevent Path Normalization Bypass in Router + Middleware Rules

Risk 43

Severity

6.9

First published (updated )

CVE-2025-66490

Apache Tomcat- Rapid Reset HTTP/2 vulnerability

Risk 65

Severity

7.5

Exploited

Zeroday

First published (updated )

CVE-2023-44487

Traefik traefikDrop Headers via Malicious Connection Header

Risk 75

Severity

8.1

First published (updated )

CVE-2021-32813

Traefik traefikconfigurationwatcher.go in Traefik 2.x before 2.1.4 and TraefikEE 2.0.0 mishandles the purging of ce…

Risk 43

Severity

7.5

First published (updated )

CVE-2020-9321

Trending

Versions

Traefik traefikTraefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false

Traefik traefikTraefik: Errors middleware forwards Authorization and Cookie headers to separate error page service

Traefik traefikTraefik: BasicAuth middleware: timing side-channel vulnerability

Traefik traefikTraefik Kubernetes CRD allows unauthorized cross-namespace middleware binding

Traefik traefikTraefik: StripPrefixRegex auth bypass via Path/RawPath desync

Don't miss critical vulnerabilities

Traefik traefikTraefik: Forwarded alias spoofing top pre-auth decision bypass

Traefik traefikTraefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth

Traefik traefikTraefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField

Traefik traefikTraefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass

Traefik traefikTraefik: BasicAuth Middleware Timing Attack Allows Username Enumeration

Don't miss critical vulnerabilities

Traefik traefikTraefik mTLS bypass via fragmented ClientHello SNI extraction failure

go/github.com/traefik/traefik/v3Traefik has a kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values

Traefik traefikTraefik: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`)

Traefik traefikTraefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (slowloris doS)

Traefik traefikTraefik: unbounded io.ReadAll on auth server response body causes OOM denial of service(DOS)

Don't miss critical vulnerabilities

go/github.com/traefik/traefik/v3Traefik: TCP readTimeout bypass via STARTTLS on Postgres

Traefik traefikTraefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall

go/github.com/traefik/traefik/v3Traefik has Inverted TLS Verification Logic in its ingress-nginx Provider

Traefik Traefik GoTraefik doesn't Prevent Path Normalization Bypass in Router + Middleware Rules

Apache Tomcat- Rapid Reset HTTP/2 vulnerability

Don't miss critical vulnerabilities

Traefik traefikDrop Headers via Malicious Connection Header

Traefik traefikconfigurationwatcher.go in Traefik 2.x before 2.1.4 and TraefikEE 2.0.0 mishandles the purging of ce…

Company

Resources

Contact