CVE-2018-15598

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-08-21 · updated 2026-06-17
Weakness: CWE-287

Description

Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable.

Affected products

Traefik: from 1.6.0 before 1.6.6 — fixed in 1.6.6

How to fix

Upgrade to a fixed version: Traefik 1.6.6. Check the vendor advisory for mitigations.

References

https://github.com/containous/traefik/pull/3790
https://github.com/containous/traefik/pull/3790/commits/113250ce5735d554c502ca16fb03bb9119ca79f1
https://github.com/containous/traefik/pull/3790/commits/368bd170913078732bde58160f92f202f370278b
https://github.com/containous/traefik/releases/tag/v1.6.6
https://github.com/containous/traefik/pull/3790
https://github.com/containous/traefik/pull/3790/commits/113250ce5735d554c502ca16fb03bb9119ca79f1
https://github.com/containous/traefik/pull/3790/commits/368bd170913078732bde58160f92f202f370278b
https://github.com/containous/traefik/releases/tag/v1.6.6

Get alerted when CVE-2018-15598 or the next vulnerability affects your stack