Skip to content
OpenAdvisories

Package · Go

github.com/traefik/traefik/v3

61 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 8.8
    CVE-2026-88009 Public exploit

    Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging

    Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evaluates routing, path sa…

    traefik traefik github.com/traefik/traefik github.com/traefik/traefik/v2 Go
  • High 7.0
    CVE-2026-88008 Public exploit

    Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization

    Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. If the backend acce…

    traefik traefik github.com/traefik/traefik github.com/traefik/traefik/v2 Go
  • High 7.8
    CVE-2026-65600 Public exploit

    Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex

    Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments wi…

    traefik traefik github.com/traefik/traefik github.com/traefik/traefik/v2 Go
  • Medium 6.0
    CVE-2026-54761 Public exploit

    Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services

    Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.21 and 3.7.5, there is a high severity vulnerability in Traefik's Kubernetes Gateway provider affecting the crossProviderNamespaces allowlist. For HTTPRoute rules that declare multiple (WRR) bac…

    traefik traefik github.com/traefik/traefik github.com/traefik/traefik/v2 Go
  • Critical 9.8
    CVE-2024-45410 Public exploit

    HTTP client can remove the X-Forwarded headers in Traefik

    Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is routed to the application. For a HTTP client, it sho…

    traefik traefik github.com/traefik/traefik github.com/traefik/traefik/v2 Alpine Go