Skip to content
OpenAdvisories

Package · Go

github.com/traefik/traefik

69 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.8
    CVE-2026-88009 Public exploit

    Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging

    Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evaluates routing, path sa…

    traefik traefik github.com/traefik/traefik github.com/traefik/traefik/v2 Go
  • High 7.0
    CVE-2026-88008 Public exploit

    Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization

    Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. If the backend acce…

    traefik traefik github.com/traefik/traefik github.com/traefik/traefik/v2 Go
  • High 7.8
    CVE-2026-65600 Public exploit

    Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex

    Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments wi…

    traefik traefik github.com/traefik/traefik github.com/traefik/traefik/v2 Go