Traefik vulnerabilities
80 CVEs and advisories name Traefik as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-71325Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef
- CVE-2026-71324Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool
- CVE-2026-67309Traefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypass
- CVE-2026-65602Traefik before 3.6.23 IngressRouteTCP ServersTransport Namespace Bypass
- CVE-2026-65601Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef
- CVE-2026-65600Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex
- CVE-2026-54763Traefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
- CVE-2026-54765Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port
- CVE-2026-54764ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false
- CVE-2026-54762Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails
- CVE-2026-54761Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services
- CVE-2026-53622Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts
- CVE-2026-48491Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass
- CVE-2026-48020Traefik StripPrefix Route-Level Auth Bypass via Path Normalization
- CVE-2023-54365Traefik - Denial of Service via HTTP/2 Request Handling
- CVE-2026-44774Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false
- CVE-2026-41181Traefik: Errors middleware forwards Authorization and Cookie headers to separate error page service
- CVE-2026-41263Traefik: BasicAuth middleware: timing side-channel vulnerability
- CVE-2026-40912Traefik: StripPrefixRegex auth bypass via Path/RawPath desync
- CVE-2026-39858Traefik: Forwarded alias spoofing top pre-auth decision bypass
- CVE-2026-35051Traefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth
- CVE-2026-41174Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding
- CVE-2026-33433Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField
- CVE-2026-32695Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass
- CVE-2026-32595Traefik: BasicAuth Middleware Timing Attack Allows Username Enumeration
- CVE-2026-32305Traefik mTLS bypass via fragmented ClientHello SNI extraction failure
- CVE-2026-29777Traefik has a kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values
- CVE-2026-29054Traefik: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`)
- CVE-2026-26999Traefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (slowloris doS)
- CVE-2026-26998Traefik: unbounded io.ReadAll on auth server response body causes OOM denial of service(DOS)