Traefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth

Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts

Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass

Traefik StripPrefix Route-Level Auth Bypass via Path Normalization

Traefik: Forwarded alias spoofing top pre-auth decision bypass

Traefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth

Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false

Traefik v3.7.0 Authentication Bypass via from-to-www-redirect

Traefik v3.7 Authentication Bypass via TLS Option Conflict

Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth

Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware

Traefik is an HTTP reverse proxy and load balancer

Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization

Traefik HTTP/3 Backend NTLM Connection Reuse

Traefik before v2.11.55 and v3.0.0 through v3.7.10 mTLS Bypass via TLS Option Conflict

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer

Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer

Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations

Traefik before 3.6.23 IngressRouteTCP ServersTransport Namespace Bypass

Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef

Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField

Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper

Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router

Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool

Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision

Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leak

Traefik v3.7.13 Authentication Bypass via ssl-passthrough Ingress HTTP Router

Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme

Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails

Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port

Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging

Traefik before v2.11.56 Identity Spoofing via Header Alias

Traefik: StripPrefixRegex auth bypass via Path/RawPath desync

Traefik: ForwardAuth identity spoofing via dot-form header alias

Traefik: Gateway API route identity collision allows cross-namespace backend hijacking

Traefik is an HTTP reverse proxy and load balancer

Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass

Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher

Traefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypass

Traefik - Denial of Service via HTTP/2 Request Handling

Traefik: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`)

Traefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (slowloris doS)

Traefik: TCP readTimeout bypass via STARTTLS on Postgres

Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall

Traefik is a golang, Cloud Native Application Proxy

Traefik is an HTTP reverse proxy and load balancer

Traefik is an HTTP reverse proxy and load balancer

Traefik is an open source HTTP reverse proxy and load balancer

Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer for deploying microservices