Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations

Traefik before 3.6.23 IngressRouteTCP ServersTransport Namespace Bypass

Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef

Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField

Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper

Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router

Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool

Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision

Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leak

Traefik v3.7.13 Authentication Bypass via ssl-passthrough Ingress HTTP Router

Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme

Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails

Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port

Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging

Traefik before v2.11.56 Identity Spoofing via Header Alias

Traefik: StripPrefixRegex auth bypass via Path/RawPath desync

Traefik: ForwardAuth identity spoofing via dot-form header alias

Traefik: Gateway API route identity collision allows cross-namespace backend hijacking

Traefik is an HTTP reverse proxy and load balancer

Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass

Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher

Traefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypass

Traefik - Denial of Service via HTTP/2 Request Handling

Traefik: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`)

Traefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (slowloris doS)

Traefik: TCP readTimeout bypass via STARTTLS on Postgres

Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall

Traefik is a golang, Cloud Native Application Proxy

Traefik is an HTTP reverse proxy and load balancer

Traefik is an HTTP reverse proxy and load balancer

Traefik is an open source HTTP reverse proxy and load balancer

Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer for deploying microservices

Traefik HTTP/2 connections management could cause a denial of service

Traefik is an HTTP reverse proxy and load balancer

Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERR_BAD_SSL_CLIENT_AUTH_CERT should have occurred

configurationwatcher.go in Traefik 2.x before 2.1.4 and TraefikEE 2.0.0 mishandles the purging of certificate contents from providers before logging

types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without sufficient access control (which is…

Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable

Traefik entrypoint header-name sanitization bypassed via request trailers

Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services