Login Request a demo
TR
Vendor
traefik
2 products with CVEs on record
82
CVEs
0
On KEV
10
New 30D
Products
TR
traefik
traefik
10.0
81 CVEs0 on KEV10 new
TE
Traefik Enterprise
Traefik
7.5
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-114656
New
TR
traefik
traefik
7.5
0%
Oct 22Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher
CVE-2026-114642
New
TR
traefik
traefik
8.7
0%
Oct 22Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper
CVE-2026-114641
New
TR
traefik
traefik
3.7
0%
Oct 22Traefik before 2.11.58 and 3.7.14 Race Condition in NTLM/Kerberos Round Tripper
CVE-2026-114640
New
TR
traefik
traefik
8.7
0%
Oct 22Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router
CVE-2026-114639
New
TR
traefik
traefik
8.7
0%
Oct 22Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool
CVE-2026-114638
New
TR
traefik
traefik
8.7
0%
Oct 22Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision
CVE-2026-114637
New
TR
traefik
traefik
8.7
0%
Oct 22Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leak
CVE-2026-114636
New
TR
traefik
traefik
8.7
0%
Oct 22Traefik v3.7.13 Authentication Bypass via ssl-passthrough Ingress HTTP Router
CVE-2026-114635
New
TR
traefik
traefik
8.7
0%
Oct 22Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme
CVE-2026-112778
TR
traefik
traefik
8.8
0%
Oct 19Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations
CVE-2026-88010
TR
traefik
traefik
6.3
1%
Sep 22Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle
CVE-2026-88012
TR
traefik
traefik
5.3
1%
Sep 10Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded
CVE-2026-88011
TR
traefik
traefik
8.1
0%
Sep 10Traefik: ForwardAuth identity spoofing via dot-form header alias
CVE-2026-88009
TR
traefik
traefik
8.2
0%
Sep 10Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
CVE-2026-88008
TR
traefik
traefik
9.1
0%
Sep 10Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization
CVE-2026-88007
TR
traefik
traefik
9.1
1%
Sep 10Traefik HTTP/3 Backend NTLM Connection Reuse
CVE-2026-88004
TR
traefik
traefik
7.4
0%
Sep 10Traefik entrypoint header-name sanitization bypassed via request trailers
CVE-2026-88879
TR
traefik
traefik
8.2
0%
Sep 10Traefik before v2.11.56 Identity Spoofing via Header Alias
CVE-2026-88878
TR
traefik
traefik
5.3
0%
Sep 10Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass
CVE-2026-88877
TR
traefik
traefik
9.8
1%
Sep 10Traefik v3.7.0 Authentication Bypass via from-to-www-redirect
CVE-2026-85597
TR
traefik
traefik
9.1
0%
Sep 4Traefik before v2.11.55 and v3.0.0 through v3.7.10 mTLS Bypass via TLS Option Conflict
CVE-2026-85596
TR
traefik
traefik
9.8
0%
Sep 4Traefik v3.7 Authentication Bypass via TLS Option Conflict
CVE-2026-85595
TR
traefik
traefik
9.8
1%
Sep 4Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth
CVE-2026-85594
TR
traefik
traefik
9.8
0%
Sep 4Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware
CVE-2026-71327
TR
traefik
traefik
8.1
0%
Aug 6Traefik: Gateway API route identity collision allows cross-namespace backend hijacking
CVE-2026-71326
TR
traefik
traefik
3.8
0%
Aug 6Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing
CVE-2026-71325
TR
traefik
traefik
4.4
0%
Aug 6Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef
CVE-2026-71324
TR
traefik
traefik
9.1
1%
Aug 6Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool
CVE-2026-67309
TR
traefik
traefik
7.5
1%
Aug 1Traefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypass
CVE-2026-65602
TR
traefik
traefik
8.8
0%
Jul 22Traefik before 3.6.23 IngressRouteTCP ServersTransport Namespace Bypass
CVE-2026-65601
TR
traefik
traefik
8.8
1%
Jul 22Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef
CVE-2026-65600
TR
traefik
traefik
5.3
1%
Jul 22Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex
CVE-2026-54763
TR
traefik
traefik
10.0
0%
Jul 6Traefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
CVE-2026-54765
TR
traefik
traefik
8.5
0%
Jul 6Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port
CVE-2026-54764
TR
traefik
traefik
5.8
0%
Jul 6ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false
CVE-2026-54762
TR
traefik
traefik
8.6
0%
Jun 23Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails
CVE-2026-54761
TR
traefik
traefik
7.1
0%
Jun 23Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services
CVE-2026-53622
TR
traefik
traefik
10.0
1%
Jun 23Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts
CVE-2026-48491
TR
traefik
traefik
10.0
0%
Jun 23Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass
CVE-2026-48020
TR
traefik
traefik
10.0
1%
Jun 23Traefik StripPrefix Route-Level Auth Bypass via Path Normalization
CVE-2023-54365
TR
Traefik
Traefik
7.5
1%
Jun 23Traefik - Denial of Service via HTTP/2 Request Handling
CVE-2026-44774
TR
traefik
traefik
9.9
0%
May 15Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false
CVE-2026-41181
TR
traefik
traefik
5.8
0%
May 15Traefik: Errors middleware forwards Authorization and Cookie headers to separate error page service
CVE-2026-41263
TR
traefik
traefik
3.7
0%
Apr 30Traefik: BasicAuth middleware: timing side-channel vulnerability
CVE-2026-40912
TR
traefik
traefik
8.2
1%
Apr 30Traefik: StripPrefixRegex auth bypass via Path/RawPath desync
CVE-2026-39858
TR
traefik
traefik
10.0
0%
Apr 30Traefik: Forwarded alias spoofing top pre-auth decision bypass
CVE-2026-35051
TR
traefik
traefik
10.0
0%
Apr 30Traefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth
CVE-2026-41174
TR
traefik
traefik
6.4
0%
Apr 30Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding
CVE-2026-33433
TR
traefik
traefik
8.8
0%
Mar 27Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField
CVE-2026-32695
TR
traefik
traefik
7.7
0%
Mar 27Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass
CVE-2026-32595
TR
traefik
traefik
3.7
0%
Mar 20Traefik: BasicAuth Middleware Timing Attack Allows Username Enumeration
CVE-2026-32305
TR
traefik
traefik
5.3
0%
Mar 20Traefik mTLS bypass via fragmented ClientHello SNI extraction failure
CVE-2026-29777
TR
traefik
traefik
6.5
0%
Mar 11Traefik has a kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values
CVE-2026-29054
TR
traefik
traefik
7.5
0%
Mar 5Traefik: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`)
CVE-2026-26999
TR
traefik
traefik
7.5
1%
Mar 5Traefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (slowloris doS)
CVE-2026-26998
TR
traefik
traefik
4.4
0%
Mar 5Traefik: unbounded io.ReadAll on auth server response body causes OOM denial of service(DOS)
CVE-2026-25949
TR
traefik
traefik
7.5
1%
Feb 12Traefik: TCP readTimeout bypass via STARTTLS on Postgres
CVE-2026-22045
TR
traefik
traefik
7.5
0%
Jan 15Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall
CVE-2025-66491
TR
traefik
traefik
5.9
0%
Dec 9Traefik has Inverted TLS Verification Logic in its ingress-nginx Provider
CVE-2025-66490
TR
traefik
traefik
6.5
0%
Dec 9Traefik doesn't Prevent Path Normalization Bypass in Router + Middleware Rules