---
id: CVE-2020-15129
aliases:
  - GHSA-6qq8-5wq3-86rp
title: Traefik vulnerable to Open Redirect via handling of X-Forwarded-Prefix header
summary: Traefik vulnerable to Open Redirect via handling of X-Forwarded-Prefix header
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N'
vendor: traefik
product: github.com/traefik/traefik
ecosystem: go
affected:
  - 'github.com/traefik/traefik >= 1.5.0-rc5, < 1.7.26'
  - github.com/traefik/traefik/v2 < 2.3.0-rc6
  - 'github.com/containous/traefik >= 1.5.0-rc5, < 1.7.26'
  - github.com/containous/traefik/v2 < 2.2.8
  - 'github.com/traefik/traefik/v2 >= 2.3.0-rc1, < 2.3.0-rc6'
  - 'github.com/containous/traefik/v2 >= 2.3.0-rc1, < 2.3.0-rc3'
  - 'github.com/traefik/traefik/api >= 1.5.0-rc5, < 1.7.26'
  - github.com/traefik/traefik/v2/pkg/api < 2.3.0-rc6
  - 'github.com/traefik/traefik/v2/pkg/api >= 2.3.0-rc1, < 2.3.0-rc6'
  - 'github.com/containous/traefik/api >= 1.5.0-rc5, < 1.7.26'
  - github.com/containous/traefik/v2/pkg/api < 2.2.8
  - 'github.com/containous/traefik/v2/pkg/api >= 2.3.0-rc1, < 2.3.0-rc3'
patched:
  - github.com/traefik/traefik 1.7.26
  - github.com/traefik/traefik/v2 2.3.0-rc6
  - github.com/containous/traefik 1.7.26
  - github.com/containous/traefik/v2 2.2.8
  - github.com/traefik/traefik/v2 2.3.0-rc6
  - github.com/containous/traefik/v2 2.3.0-rc3
  - github.com/traefik/traefik/api 1.7.26
  - github.com/traefik/traefik/v2/pkg/api 2.3.0-rc6
  - github.com/traefik/traefik/v2/pkg/api 2.3.0-rc6
  - github.com/containous/traefik/api 1.7.26
  - github.com/containous/traefik/v2/pkg/api 2.2.8
  - github.com/containous/traefik/v2/pkg/api 2.3.0-rc3
published: '2022-02-11'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-6qq8-5wq3-86rp'
references:
  - url: >-
      https://github.com/containous/traefik/security/advisories/GHSA-6qq8-5wq3-86rp
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2020-15129'
  - url: 'https://github.com/containous/traefik/pull/7109'
  - url: >-
      https://github.com/containous/traefik/commit/cfa04c300c5db95ae8a52c31a9d973b6dd9c2254
  - url: >-
      https://github.com/containous/traefik/commit/e63db782c11c7b8bfce30be4c902e7ef8f9f33d2
  - url: >-
      https://github.com/traefik/traefik/commit/e2c5f3712f68993de8ed3cb30da9ec0aa11acb09
  - url: 'https://github.com/containous/traefik/releases/tag/v1.7.26'
  - url: 'https://github.com/containous/traefik/releases/tag/v2.2.8'
  - url: 'https://github.com/containous/traefik/releases/tag/v2.3.0-rc3'
  - url: 'https://github.com/traefik/traefik'
tags:
  - osv
  - go
  - exploit-available
epss: 0.08011
epssPercentile: 0.94575
ingestedAt: '2026-07-09T18:56:36.006Z'
exploits:
  nuclei:
    - CVE-2020-15129
  checkedAt: '2026-09-27T10:33:26.532Z'
exploitAvailable: true
---

## Overview

## Summary

There exists a potential open redirect vulnerability in Traefik's handling of the `X-Forwarded-Prefix` header. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team addressed this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios.

## Details

The Traefik API dashboard component doesn't validate that the value of the header `X-Forwarded-Prefix` is a site relative path and will redirect to any header provided URI.

e.g.

```
$ curl --header 'Host:traefik.localhost' --header 'X-Forwarded-Prefix:https://example.org' 'http://localhost:8081'
<a href="https://example.org/dashboard/">Found</a>.`
```

### Impact
A successful exploitation of an open redirect can be used to entice victims to disclose sensitive information.

### Workarounds

By using the `headers` middleware, the request header `X-Forwarded-Prefix` value can be overridden by the value `.` (dot)

- https://docs.traefik.io/v2.2/middlewares/headers/#customrequestheaders
- https://docs.traefik.io/v1.7/basics/#custom-headers

### For more information

If you have any questions or comments about this advisory, open an issue in [Traefik](https://github.com/containous/traefik/issues).

## Credit

This issue was found by the GitHub Application Security Team and reported on behalf of the GHAS by the GitHub Security Lab Team.

## Affected packages

- `github.com/traefik/traefik >= 1.5.0-rc5, < 1.7.26`
- `github.com/traefik/traefik/v2 < 2.3.0-rc6`
- `github.com/containous/traefik >= 1.5.0-rc5, < 1.7.26`
- `github.com/containous/traefik/v2 < 2.2.8`
- `github.com/traefik/traefik/v2 >= 2.3.0-rc1, < 2.3.0-rc6`
- `github.com/containous/traefik/v2 >= 2.3.0-rc1, < 2.3.0-rc3`
- `github.com/traefik/traefik/api >= 1.5.0-rc5, < 1.7.26`
- `github.com/traefik/traefik/v2/pkg/api < 2.3.0-rc6`
- `github.com/traefik/traefik/v2/pkg/api >= 2.3.0-rc1, < 2.3.0-rc6`
- `github.com/containous/traefik/api >= 1.5.0-rc5, < 1.7.26`
- `github.com/containous/traefik/v2/pkg/api < 2.2.8`
- `github.com/containous/traefik/v2/pkg/api >= 2.3.0-rc1, < 2.3.0-rc3`

## Remediation

Upgrade to a patched release:

- `github.com/traefik/traefik 1.7.26`
- `github.com/traefik/traefik/v2 2.3.0-rc6`
- `github.com/containous/traefik 1.7.26`
- `github.com/containous/traefik/v2 2.2.8`
- `github.com/traefik/traefik/v2 2.3.0-rc6`
- `github.com/containous/traefik/v2 2.3.0-rc3`
- `github.com/traefik/traefik/api 1.7.26`
- `github.com/traefik/traefik/v2/pkg/api 2.3.0-rc6`
- `github.com/traefik/traefik/v2/pkg/api 2.3.0-rc6`
- `github.com/containous/traefik/api 1.7.26`
- `github.com/containous/traefik/v2/pkg/api 2.2.8`
- `github.com/containous/traefik/v2/pkg/api 2.3.0-rc3`