What’s Vulnerable › Products

Traefik vulnerabilities

82 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 61 published in the last 12 months.

Check whether your Traefik version is affected

Exploited Traefik vulnerabilities

• CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability

Latest Traefik vulnerabilities

• CVE-2026-114656 — Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher (CVSS 7.5)
• CVE-2026-114642 — Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper (CVSS 8.7)
• CVE-2026-114641 — Traefik before 2.11.58 and 3.7.14 Race Condition in NTLM/Kerberos Round Tripper (CVSS 3.7)
• CVE-2026-114639 — Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool (CVSS 8.7)
• CVE-2026-114638 — Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision (CVSS 8.7)
• CVE-2026-114637 — Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leak (CVSS 8.7)
• CVE-2026-114635 — Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme (CVSS 8.7)
• CVE-2026-114640 — Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router (CVSS 8.7)
• CVE-2026-114636 — Traefik v3.7.13 Authentication Bypass via ssl-passthrough Ingress HTTP Router (CVSS 8.7)
• CVE-2026-112778 — Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations (CVSS 8.8)
• CVE-2026-88010 — Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle (CVSS 6.3)
• CVE-2026-88012 — Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded (CVSS 5.3)
• CVE-2026-88011 — Traefik: ForwardAuth identity spoofing via dot-form header alias (CVSS 8.1)
• CVE-2026-88009 — Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging (CVSS 8.2)
• CVE-2026-88008 — Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization (CVSS 9.1)
• CVE-2026-88007 — Traefik HTTP/3 Backend NTLM Connection Reuse (CVSS 9.1)
• CVE-2026-88004 — Traefik entrypoint header-name sanitization bypassed via request trailers (CVSS 7.4)
• CVE-2026-88879 — Traefik before v2.11.56 Identity Spoofing via Header Alias (CVSS 8.2)
• CVE-2026-88878 — Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass (CVSS 5.3)
• CVE-2026-88877 — Traefik v3.7.0 Authentication Bypass via from-to-www-redirect (CVSS 9.8)
• CVE-2026-85597 — Traefik before v2.11.55 and v3.0.0 through v3.7.10 mTLS Bypass via TLS Option Conflict (CVSS 9.1)
• CVE-2026-85596 — Traefik v3.7 Authentication Bypass via TLS Option Conflict (CVSS 9.8)
• CVE-2026-85595 — Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth (CVSS 9.8)
• CVE-2026-85594 — Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware (CVSS 9.8)
• CVE-2026-71327 — Traefik: Gateway API route identity collision allows cross-namespace backend hijacking (CVSS 8.1)