VulnSea

Traefik has 54 CVEs on record between 2021 and 2026. Disclosure cadence is accelerating: 24 in the last 90 days against 9 in the 90 before. The busiest recent month was September 2026 with 13. The median CVSS is 7.5 (high), with 9 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-863 (8) and CWE-287 (4). Most affected products: traefik (22), github.com/traefik/traefik/v2 (15), github.com/traefik/traefik/v3 (11).

CVEs per month

Last 12 months, by publish date

101112010203040506070809
Exploited share
0% vs 1% corpus
Median CVSS
7.5
Publish → KEV
—
Last 90 days
24 prev 9

Products

  • traefik 22
  • github.com/traefik/traefik/v2 15
  • github.com/traefik/traefik/v3 11
  • github.com/traefik/traefik 6
Follow Traefik:RSS feedSave a search →Embed badge ↗
54
Total CVEs
9
Critical
0
CISA KEV
0
Exploited

Worst active — by depth score

Traefik vulnerabilities

CVEs affecting Traefik, newest first. Open any entry for full detail, references, and exploit status.

54 CVEsRSS

CVE-2026-88012Medium· 5.3
1w ago

Traefik is an open source HTTP reverse proxy and load balancer

Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connectio…

▾ Sunlittraefik · traefikEPSS 0.30%via NVD
CVE-2026-88877Critical· 9.8
1w ago

Traefik is a HTTP reverse proxy and load balancer

Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-…

▾ Midnighttraefik · traefikEPSS 0.44%via NVD
CVE-2026-88009High· 8.2
1w ago

Traefik is an open source HTTP reverse proxy and load balancer

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path eval…

▾ Twilighttraefik · traefikEPSS 0.27%via NVD
CVE-2026-88004High· 7.4
1w ago

Traefik is an open source HTTP reverse proxy and load balancer

Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but not req.Trailer, allowing a…

▾ Twilighttraefik · traefikEPSS 0.27%via NVD
CVE-2026-88008Critical· 9.1⚖ disputed
1w ago

Traefik is an open source HTTP reverse proxy and load balancer

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backen…

▾ Midnighttraefik · traefikEPSS 0.34%via NVD
CVE-2026-88011High· 8.1⚖ disputed
1w ago

Traefik is an open source HTTP reverse proxy and load balancer

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy …

▾ Twilighttraefik · traefikEPSS 0.24%via NVD
CVE-2026-88007Critical· 9.1
1w ago

Traefik is an open source HTTP reverse proxy and load balancer

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport …

▾ Midnighttraefik · traefikEPSS 0.33%via NVD
CVE-2026-88879High· 8.2⚖ disputed
1w ago

Traefik is an HTTP reverse proxy and load balancer

Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so X-Auth-User, X_Auth_User and X.Auth.User are treated as three disti…

▾ Twilighttraefik · traefikEPSS 0.21%via NVD
CVE-2026-88878Medium· 5.3⚖ disputed
1w ago

Traefik is an HTTP reverse proxy and load balancer

Traefik is an HTTP reverse proxy and load balancer. In versions >= v2.8.2 through <= v2.11.55 and >= v3.0.0 through <= v3.7.11, the entryPoints.<name>.transport.respondingTimeouts settings — notably readTimeout, which is enabled by defau…

▾ Sunlittraefik · traefikEPSS 0.30%via NVD
CVE-2026-85594Critical· 9.8⚖ disputed
2w ago

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from th…

▾ Midnighttraefik · traefikEPSS 0.26%via NVD
CVE-2026-85597Critical· 9.1
2w ago

Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host…

Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host…

▾ Midnighttraefik · traefikEPSS 0.21%via NVD
CVE-2026-85596Critical· 9.8⚖ disputed
2w ago

Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider

Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress carrying the nginx.ingress.kubernetes.io/auth-tls-secret annotation was named af…

▾ Midnighttraefik · traefikEPSS 0.24%via NVD
CVE-2026-85595Critical· 9.8
2w ago

Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection

Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute …

▾ Midnighttraefik · traefikEPSS 0.45%via NVD
CVE-2026-71326Low· 3.8
1mo ago

Traefik is an open source HTTP reverse proxy and load balancer

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basic_auth.go deduplicates concurrent password checks with a singleflight key bui…

▾ Sunlittraefik · traefikEPSS 0.26%via NVD
CVE-2026-71327High· 8.1
1mo ago

Traefik is an open source HTTP reverse proxy and load balancer

Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go bui…

▾ Twilighttraefik · traefikEPSS 0.35%via NVD
CVE-2026-54764Medium· 5.8
1mo ago

Traefik: ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false

Traefik: ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false

▾ Sunlittraefik · github.com/traefik/traefik/v2EPSS 0.28%via GHSA
CVE-2026-71325Medium· 4.4⚖ disputed
1mo ago

Traefik is an open-source edge router that makes publishing services a fun and easy experience

Traefik is an open-source edge router that makes publishing services a fun and easy experience. Prior to 2.11.54, 3.6.25, and 3.7.10, cross-namespace @kubernetescrd references are not rejected for TraefikService backend references resolv…

▾ Sunlittraefik · traefikEPSS 0.14%via NVD
CVE-2026-54765Medium
1mo ago

Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port

Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port

▾ Sunlittraefik · github.com/traefik/traefik/v3EPSS 0.28%via GHSA
CVE-2026-65600Critical· 9.1
1mo ago

Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware

Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware

▾ Midnighttraefik · github.com/traefik/traefik/v2EPSS 0.41%via GHSA
CVE-2026-54763High
1mo ago

Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth

Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth

▾ Twilighttraefik · github.com/traefik/traefik/v2EPSS 0.21%via GHSA
CVE-2026-71324Critical· 9.1
1mo ago

Traefik is an open source HTTP reverse proxy and load balancer

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/3 CONNECT request and its body to an HTTP/1.1 upstream through a sh…

▾ Midnighttraefik · traefikEPSS 0.51%via NVD
CVE-2026-65602Medium
1mo ago

Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass

Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass

▾ Sunlittraefik · github.com/traefik/traefik/v3EPSS 0.18%via GHSA
CVE-2026-65601Medium
1mo ago

Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion

Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion

▾ SunlitTraefik · TraefikEPSS 0.29%via GHSA
CVE-2026-67309High· 7.5
1mo ago

Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware (generated from the nginx.ingress.kubernetes.io/rewrite-target annotation)

Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware (generated from the nginx.ingress.kubernetes.io/rewrite-target annotation). When an Ingre…

▾ Twilighttraefik · traefikEPSS 0.53%via NVD
CVE-2026-54762High· 8.6
3mo ago

Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails

Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails

▾ Twilighttraefik · github.com/traefik/traefik/v3EPSS 0.43%via OSV
CVE-2026-54761High· 7.1PoC
3mo ago

Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services

Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services

▾ Midnighttraefik · github.com/traefik/traefik/v3EPSS 0.37%via OSV
CVE-2026-48491High
3mo ago

Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass

Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass

▾ TwilightTraefik · TraefikEPSS 0.36%via GHSA
CVE-2026-53622High
3mo ago

Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts

Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts

▾ TwilightTraefik · TraefikEPSS 0.63%via GHSA
CVE-2026-48020HighPoC
3mo ago

Traefik has a StripPrefix Route-Level Auth Bypass via Path Normalization

Traefik has a StripPrefix Route-Level Auth Bypass via Path Normalization

▾ Midnighttraefik · github.com/traefik/traefik/v2EPSS 0.78%via GHSA
CVE-2026-41181Medium
4mo ago

Traefik's errors middleware forwards Authorization and Cookie headers to separate error page service

Traefik's errors middleware forwards Authorization and Cookie headers to separate error page service

▾ Sunlittraefik · github.com/traefik/traefik/v2EPSS 0.45%via OSV
Traefik vulnerabilities (CVEs) · VulnSea