# cve.now: Traefik

The newest entries naming Traefik as an affected vendor (up to 200), of 80 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-121966](https://cve.now/CVE-2026-121966.md): Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak (CVSS 7.0)
- [CVE-2026-119574](https://cve.now/CVE-2026-119574.md): Traefik 3.2.0 before 3.7.15 FastProxy Data Race Denial of Service (CVSS 8.2)
- [CVE-2026-119573](https://cve.now/CVE-2026-119573.md): Traefik 3.7.11 before 3.7.15 Cross-Namespace Authorization Bypass via auth-tls-secret (CVSS 2.1)
- [CVE-2026-119572](https://cve.now/CVE-2026-119572.md): Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider (CVSS 7.0)
- [CVE-2026-114656](https://cve.now/CVE-2026-114656.md): Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher (CVSS 6.9)
- [CVE-2026-114642](https://cve.now/CVE-2026-114642.md): Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper (CVSS 7.0)
- [CVE-2026-114641](https://cve.now/CVE-2026-114641.md): Traefik before 2.11.58 and 3.7.14 Race Condition in NTLM/Kerberos Round Tripper (CVSS 6.3)
- [CVE-2026-114640](https://cve.now/CVE-2026-114640.md): Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router (CVSS 7.0)
- [CVE-2026-114639](https://cve.now/CVE-2026-114639.md): Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool (CVSS 7.0)
- [CVE-2026-114638](https://cve.now/CVE-2026-114638.md): Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision (CVSS 7.0)
- [CVE-2026-114637](https://cve.now/CVE-2026-114637.md): Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leak (CVSS 7.0)
- [CVE-2026-114636](https://cve.now/CVE-2026-114636.md): Traefik v3.7.13 Authentication Bypass via ssl-passthrough Ingress HTTP Router (CVSS 7.0)
- [CVE-2026-114635](https://cve.now/CVE-2026-114635.md): Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme (CVSS 7.0)
- [CVE-2026-112778](https://cve.now/CVE-2026-112778.md): Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations (CVSS 6.4)
- [CVE-2026-88010](https://cve.now/CVE-2026-88010.md): Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle (CVSS 6.3)
- [CVE-2026-88012](https://cve.now/CVE-2026-88012.md): Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded (CVSS 5.3)
- [CVE-2026-88011](https://cve.now/CVE-2026-88011.md): Traefik: ForwardAuth identity spoofing via dot-form header alias (CVSS 5.3)
- [CVE-2026-88009](https://cve.now/CVE-2026-88009.md): Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging (CVSS 8.8)
- [CVE-2026-88008](https://cve.now/CVE-2026-88008.md): Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization (CVSS 7.0)
- [CVE-2026-88007](https://cve.now/CVE-2026-88007.md): Traefik HTTP/3 Backend NTLM Connection Reuse (CVSS 9.1)
- [CVE-2026-88004](https://cve.now/CVE-2026-88004.md): Traefik entrypoint header-name sanitization bypassed via request trailers (CVSS 7.0)
- [CVE-2026-88879](https://cve.now/CVE-2026-88879.md): Traefik before v2.11.56 Identity Spoofing via Header Alias (CVSS 5.3)
- [CVE-2026-88878](https://cve.now/CVE-2026-88878.md): Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass (CVSS 6.9)
- [CVE-2026-88877](https://cve.now/CVE-2026-88877.md): Traefik v3.7.0 Authentication Bypass via from-to-www-redirect (CVSS 9.3)
- [CVE-2026-85597](https://cve.now/CVE-2026-85597.md): Traefik before v2.11.55 and v3.0.0 through v3.7.10 mTLS Bypass via TLS Option Conflict (CVSS 8.2)
- [CVE-2026-85596](https://cve.now/CVE-2026-85596.md): Traefik v3.7 Authentication Bypass via TLS Option Conflict (CVSS 8.2)
- [CVE-2026-85595](https://cve.now/CVE-2026-85595.md): Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth (CVSS 9.3)
- [CVE-2026-85594](https://cve.now/CVE-2026-85594.md): Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware (CVSS 7.0)
- [CVE-2026-71327](https://cve.now/CVE-2026-71327.md): Traefik: Gateway API route identity collision allows cross-namespace backend hijacking (CVSS 7.6)
- [CVE-2026-71326](https://cve.now/CVE-2026-71326.md): Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing (CVSS 2.1)
- [CVE-2026-71325](https://cve.now/CVE-2026-71325.md): Traefik: \`allowCrossNamespace=false\` bypass via \`@kubernetescrd\` TraefikService backendRef (CVSS 4.8)
- [CVE-2026-71324](https://cve.now/CVE-2026-71324.md): Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool (CVSS 7.0)
- [CVE-2026-67309](https://cve.now/CVE-2026-67309.md): Traefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypass (CVSS 7.8)
- [CVE-2026-65602](https://cve.now/CVE-2026-65602.md): Traefik before 3.6.23 IngressRouteTCP ServersTransport Namespace Bypass (CVSS 5.3)
- [CVE-2026-65601](https://cve.now/CVE-2026-65601.md): Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef (CVSS 5.3)
- [CVE-2026-65600](https://cve.now/CVE-2026-65600.md): Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex (CVSS 7.8)
- [CVE-2026-54763](https://cve.now/CVE-2026-54763.md): Traefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth (CVSS 7.8)
- [CVE-2026-54765](https://cve.now/CVE-2026-54765.md): Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port (CVSS 6.3)
- [CVE-2026-54764](https://cve.now/CVE-2026-54764.md): ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false (CVSS 6.9)
- [CVE-2026-54762](https://cve.now/CVE-2026-54762.md): Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails (CVSS 5.9)
- [CVE-2026-54761](https://cve.now/CVE-2026-54761.md): Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services (CVSS 6.0)
- [CVE-2026-53622](https://cve.now/CVE-2026-53622.md): Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts (CVSS 7.8)
- [CVE-2026-48491](https://cve.now/CVE-2026-48491.md): Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass (CVSS 7.8)
- [CVE-2026-48020](https://cve.now/CVE-2026-48020.md): Traefik StripPrefix Route-Level Auth Bypass via Path Normalization (CVSS 7.8)
- [CVE-2023-54365](https://cve.now/CVE-2023-54365.md): Traefik - Denial of Service via HTTP/2 Request Handling (CVSS 8.7)
- [CVE-2026-44774](https://cve.now/CVE-2026-44774.md): Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false (CVSS 6.4)
- [CVE-2026-41181](https://cve.now/CVE-2026-41181.md): Traefik: Errors middleware forwards Authorization and Cookie headers to separate error page service (CVSS 6.9)
- [CVE-2026-41263](https://cve.now/CVE-2026-41263.md): Traefik: BasicAuth middleware: timing side-channel vulnerability (CVSS 6.3)
- [CVE-2026-40912](https://cve.now/CVE-2026-40912.md): Traefik: StripPrefixRegex auth bypass via Path/RawPath desync (CVSS 7.8)
- [CVE-2026-39858](https://cve.now/CVE-2026-39858.md): Traefik: Forwarded alias spoofing top pre-auth decision bypass (CVSS 7.8)
- [CVE-2026-35051](https://cve.now/CVE-2026-35051.md): Traefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth (CVSS 7.8)
- [CVE-2026-41174](https://cve.now/CVE-2026-41174.md): Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding (CVSS 4.8)
- [CVE-2026-33433](https://cve.now/CVE-2026-33433.md): Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField (CVSS 5.1)
- [CVE-2026-32695](https://cve.now/CVE-2026-32695.md): Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass (CVSS 6.3)
- [CVE-2026-32595](https://cve.now/CVE-2026-32595.md): Traefik: BasicAuth Middleware Timing Attack Allows Username Enumeration (CVSS 6.3)
- [CVE-2026-32305](https://cve.now/CVE-2026-32305.md): Traefik mTLS bypass via fragmented ClientHello SNI extraction failure (CVSS 7.8)
- [CVE-2026-29777](https://cve.now/CVE-2026-29777.md): Traefik has a kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values (CVSS 6.1)
- [CVE-2026-29054](https://cve.now/CVE-2026-29054.md): Traefik: lowercase \`Connection\` tokens can delete traefik-managed forwarded identity headers (for example, \`X-Real-Ip\`) (CVSS 7.5)
- [CVE-2026-26999](https://cve.now/CVE-2026-26999.md): Traefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (slowloris doS) (CVSS 7.5)
- [CVE-2026-26998](https://cve.now/CVE-2026-26998.md): Traefik: unbounded io.ReadAll on auth server response body causes OOM denial of service(DOS) (CVSS 4.4)
- [CVE-2026-25949](https://cve.now/CVE-2026-25949.md): Traefik: TCP readTimeout bypass via STARTTLS on Postgres (CVSS 7.5)
- [CVE-2026-22045](https://cve.now/CVE-2026-22045.md): Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall (CVSS 5.9)
- [CVE-2025-66491](https://cve.now/CVE-2025-66491.md): Traefik has Inverted TLS Verification Logic in its ingress-nginx Provider (CVSS 5.9)
- [CVE-2025-66490](https://cve.now/CVE-2025-66490.md): Traefik doesn't Prevent Path Normalization Bypass in Router + Middleware Rules (CVSS 6.9)
- [CVE-2025-54386](https://cve.now/CVE-2025-54386.md): Traefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code Execution (CVSS 7.3)
- [CVE-2025-47952](https://cve.now/CVE-2025-47952.md): Traefik allows path traversal using url encoding (CVSS 2.9)
- [CVE-2025-32431](https://cve.now/CVE-2025-32431.md): Traefik has a possible vulnerability with the path matchers (CVSS 8.8)
- [CVE-2024-52003](https://cve.now/CVE-2024-52003.md): X-Forwarded-Prefix Header still allows for Open Redirect in traefik (CVSS 6.3)
- [CVE-2024-45410](https://cve.now/CVE-2024-45410.md): HTTP client can remove the X-Forwarded headers in Traefik (CVSS 9.8)
- [CVE-2024-39321](https://cve.now/CVE-2024-39321.md): Traefik vulnerable to bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes (CVSS 7.5)
- [CVE-2024-28869](https://cve.now/CVE-2024-28869.md): Possible denial of service vulnerability with Content-length header in Traefik (CVSS 7.5)
- [CVE-2023-47633](https://cve.now/CVE-2023-47633.md): Uncontrolled Resource Consumption in Traefik (CVSS 7.5)
- [CVE-2023-47106](https://cve.now/CVE-2023-47106.md): Incorrect processing of fragment in the URL leads to Authorization Bypass in Traefik (CVSS 4.8)
- [CVE-2023-47124](https://cve.now/CVE-2023-47124.md): Denial of service whith ACME HTTPChallenge in Traefik (CVSS 5.9)
- [CVE-2023-29013](https://cve.now/CVE-2023-29013.md): HTTP header parsing could cause a deny of service (CVSS 7.5)
- [CVE-2022-46153](https://cve.now/CVE-2022-46153.md): Routes exposed with an empty TLSOption in traefik (CVSS 8.1)
- [CVE-2022-23469](https://cve.now/CVE-2022-23469.md): Authorization header displayed in the debug logs (CVSS 3.5)
- [CVE-2022-39271](https://cve.now/CVE-2022-39271.md): Traefik HTTP/2 connections management could cause a denial of service (CVSS 7.5)
- [CVE-2022-23632](https://cve.now/CVE-2022-23632.md): Traefik skips the router TLS configuration when the host header is an FQDN (CVSS 7.4)
- [CVE-2021-32813](https://cve.now/CVE-2021-32813.md): Drop Headers via Malicious Connection Header (CVSS 4.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/traefik
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.