traefik vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-114642 Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, High 7 · Oct 21, 2026
• CVE-2026-114640 Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-ClHigh 7 · Oct 21, 2026
• CVE-2026-114639 Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: NegotiatHigh 7 · Oct 21, 2026
• CVE-2026-114638 Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-seHigh 7 · Oct 21, 2026
• CVE-2026-114637 Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/NegotiHigh 7 · Oct 21, 2026
• CVE-2026-114636 Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough IHigh 7 · Oct 21, 2026
• CVE-2026-114635 Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil.High 7 · Oct 21, 2026
• CVE-2026-88009 Traefik is an open source HTTP reverse proxy and load balancer.High 8.8 · Sep 10, 2026
• CVE-2026-88008 Traefik is an open source HTTP reverse proxy and load balancer.High 7 · Sep 10, 2026
• CVE-2026-88007 Traefik is an open source HTTP reverse proxy and load balancer.Critical 9.1 · Sep 10, 2026
• CVE-2026-88004 Traefik is an open source HTTP reverse proxy and load balancer.High 7 · Sep 10, 2026
• CVE-2026-88877 Traefik is a HTTP reverse proxy and load balancer.Critical 9.3 · Sep 10, 2026
• CVE-2026-85597 Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass clientHigh 8.2 · Sep 4, 2026
• CVE-2026-85596 Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider.High 8.2 · Sep 4, 2026
• CVE-2026-85595 Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown uCritical 9.3 · Sep 4, 2026
• CVE-2026-85594 Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation inHigh 7 · Sep 4, 2026
• CVE-2026-71327 Traefik is an open source HTTP reverse proxy and load balancer.High 7.6 · Aug 6, 2026
• CVE-2026-71324 Traefik is an open source HTTP reverse proxy and load balancer.High 7 · Aug 6, 2026
• CVE-2026-67309 Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware (generated fHigh 7.8 · Aug 1, 2026
• CVE-2026-65600 Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middlewaHigh 7.8 · Jul 22, 2026
• CVE-2026-54763 Traefik is an HTTP reverse proxy and load balancer.High 7.8 · Jul 6, 2026
• CVE-2026-53622 Traefik is an HTTP reverse proxy and load balancer.High 7.8 · Jun 23, 2026
• CVE-2026-48491 Traefik is an HTTP reverse proxy and load balancer.High 7.8 · Jun 23, 2026
• CVE-2026-48020 Traefik is an HTTP reverse proxy and load balancer.High 7.8 · Jun 23, 2026
• CVE-2023-54365 Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/High 8.7 · Jun 23, 2026