Traefik data race in experimental FastProxy allows unauthenticated process crash (EUVD-2026-113928)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Traefik
- Product
- traefik
- First seen
Summary
The EU Vulnerability Database (EUVD) lists a data race in the experimental FastProxy of Traefik 3.2.0 before 3.7.15 that it scores 8.2/10 (CVSS v3.1). According to the entry, unauthenticated attackers can crash the process by repeatedly opening and aborting HTTP/1 protocol upgrades such as WebSocket.
If you use Traefik
Upgrade Traefik to 3.7.15 or later
Disable the experimental FastProxy if it is enabled
Monitor proxy processes for repeated crashes
Verify mTLS is enforced on affected ingress hosts after upgrading
Check for other Ingress paths on the same host that could bypass mTLS
Limit who can create Ingress objects across namespaces
What the sources say 3
· Mastodon: “Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1 protocol upgrades.” Source
· Mastodon: “Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cross-namespace check on the auth-tls-secret annotation when a cached client authentication TLS option is reused.” Source
· Mastodon: “Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider that silently disables mTLS configured via the auth-tls-secret annotation.” Source