Skip to content
OpenAdvisories

Package · Wolfi

traefik-3.6

71 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.5
    CVE-2026-114656 Public exploit

    Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher

    Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by Requ…

    traefik traefik traefik-3.6 Wolfi
  • High 8.8
    CVE-2026-88009 Public exploit

    Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging

    Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evaluates routing, path sa…

    traefik traefik traefik-3.6 github.com/traefik/traefik Wolfi Go
  • High 7.0
    CVE-2026-88008 Public exploit

    Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization

    Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. If the backend acce…

    traefik traefik traefik-3.6 github.com/traefik/traefik Wolfi Go
  • High 7.5
    CVE-2026-56852 Public exploit

    Infinite loop on invalid input in golang.org/x/text

    A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

    golang.org/x/text golang.org/x/text/unicode/norm zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  • High 7.3
    CVE-2026-39883 Public exploit

    OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on …

    open-telemetry opentelemetry-go zot kubescape Ubuntu Wolfi Go
  • High 8.8
    CVE-2026-34040 Public exploit

    Moby: AuthZ plugin bypass with oversized request body

    Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.

    moby moby zot kots Debian Ubuntu Alpine Wolfi Go