TR
Product
traefik
81
CVEs
0
On KEV
10.0
Max CVSS
10
New 30D
Severity mix
Critical 18High 40Medium 19Low 4
Watch
Add traefik to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-39271 | 7.5 | Oct 11 | Traefik HTTP/2 connections management could cause a denial of service Affected: < 2.8.8; >= 2.9.0-rc1, < 2.9.0-rc5 |
| CVE-2022-23632 | 7.5 | Feb 17 | Traefik is an HTTP reverse proxy and load balancer Affected: before 2.6.1 |
| CVE-2019-20894 | 7.5 | Jul 2 | Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERR_BAD_SSL_CLIENT_AUTH_CERT should have occurred Affected: 2.0.0 before 2.0.1 |
| CVE-2020-9321 | 7.5 | Mar 16 | configurationwatcher.go in Traefik 2.x before 2.1.4 and TraefikEE 2.0.0 mishandles the purging of certificate contents from providers before logging Affected: 2.0.0 through 2.1.4 |
| CVE-2019-12452 | 7.5 | May 29 | types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without sufficient access control (which is… Affected: 1.7.0 through 1.7.11 |
| CVE-2018-15598 | 7.5 | Aug 21 | Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable Affected: 1.6.0 before 1.6.6 |
| CVE-2026-88004 | 7.4 | Sep 10 | Traefik entrypoint header-name sanitization bypassed via request trailers Affected: >= 3.2.0, < 3.7.13 |
| CVE-2026-54761 | 7.1 | Jun 23 | Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services Affected: < 3.6.21; >= 3.7.0-ea.1, < 3.7.5 |
| CVE-2026-29777 | 6.5 | Mar 11 | Traefik has a kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values Affected: < 3.6.10 |
| CVE-2025-66490 | 6.5 | Dec 9 | Traefik doesn't Prevent Path Normalization Bypass in Router + Middleware Rules Affected: github.com/traefik/traefik/v3 < 3.6.3; github.com/traefik/traefik/v2 < 2.11.32; github.com/traefik/traefik <= 1.7.34 |
| CVE-2023-47106 | 6.5 | Dec 4 | Traefik is an open source HTTP reverse proxy and load balancer Affected: through 2.10.5; 3.0.0; 3.0.0; 3.0.0; 3.0.0 |
| CVE-2022-46153 | 6.5 | Dec 8 | Traefik is an open source HTTP reverse proxy and load balancer Affected: before 2.9.6 |
| CVE-2022-23469 | 6.5 | Dec 8 | Traefik is an open source HTTP reverse proxy and load balancer Affected: before 2.9.6 |
| CVE-2026-41174 | 6.4 | Apr 30 | Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding Affected: < 2.11.43; >= 3.7.0-ea.1, < 3.7.0-rc.2 |
| CVE-2026-88010 | 6.3 | Sep 22 | Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle Affected: >= 3.6.11, < 3.7.13 |
| CVE-2024-52003 | 6.1 | Nov 29 | Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer Affected: before 2.11.14; 3.0.0 before 3.2.1 |
| CVE-2025-66491 | 5.9 | Dec 9 | Traefik has Inverted TLS Verification Logic in its ingress-nginx Provider Affected: >= 3.5.0, < 3.6.3 |
| CVE-2023-47124 | 5.9 | Dec 4 | Traefik is an open source HTTP reverse proxy and load balancer Affected: through 2.10.5; 3.0.0; 3.0.0; 3.0.0; 3.0.0 |
| CVE-2026-54764 | 5.8 | Jul 6 | ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false Affected: < 2.11.51; >= 3.0.0, < 3.6.22; >= 3.7.0, < 3.7.6 |
| CVE-2026-41181 | 5.8 | May 15 | Traefik: Errors middleware forwards Authorization and Cookie headers to separate error page service Affected: >= 3.7.0-rc.0, < 3.7.0-rc.3; >= 3.0.0-beta1, < 3.6.14; < 2.11.43 |
| CVE-2026-88012 | 5.3 | Sep 10 | Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded Affected: >= 2.8.2, < 2.11.56; >= 3.0.0, < 3.7.12 |
| CVE-2026-88878 | 5.3 | Sep 10 | Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass Affected: 2.8.2 through 3.7.13; 3.0.0 through 3.7.13 |
| CVE-2026-65600 | 5.3 | Jul 22 | Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex Affected: before 2.11.52; 3.6.0 before 3.6.23; 3.7.0 before 3.7.7 |
| CVE-2026-32305 | 5.3 | Mar 20 | Traefik mTLS bypass via fragmented ClientHello SNI extraction failure Affected: < 2.11.41; >= 3.0.0-beta1, < 3.6.11; >= 3.7.0-ea.1, < 3.7.0-ea.2 |
| CVE-2020-15129 | 4.7 | Jul 30 | In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, there exists a potential open redirect vulnerability in Traefik's handling of the "X-Forwarded-Prefix" header Affected: before 1.7.26; 2.2.0 before 2.2.8; 2.3.0; 2.3.0; 2.3.0 |
| CVE-2026-71325 | 4.4 | Aug 6 | Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef Affected: < 2.11.54; >= 3.0.0, < 3.6.25; >= 3.7.0, < 3.7.10 |
| CVE-2026-26998 | 4.4 | Mar 5 | Traefik: unbounded io.ReadAll on auth server response body causes OOM denial of service(DOS) Affected: < 2.11.38; < 3.6.9 |
| CVE-2026-71326 | 3.8 | Aug 6 | Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing Affected: >= 3.6.11, < 3.6.25; >= 3.7.0, < 3.7.10 |
| CVE-2026-114641 New | 3.7 | Oct 22 | Traefik before 2.11.58 and 3.7.14 Race Condition in NTLM/Kerberos Round Tripper Affected: 2.11.0 before 2.11.58; 3.0.0 before 3.7.14 |
| CVE-2026-41263 | 3.7 | Apr 30 | Traefik: BasicAuth middleware: timing side-channel vulnerability Affected: < 2.11.43; >= 3.0.0-beta1, < 3.6.14; >= 3.7.0-ea.1, < 3.7.0-rc.2 |
| CVE-2026-32595 | 3.7 | Mar 20 | Traefik: BasicAuth Middleware Timing Attack Allows Username Enumeration Affected: < 2.11.41; >= 3.0.0-beta1, < 3.6.11; >= 3.7.0-ea.1, < 3.7.0-ea.2 |