Vulnerability · Published May 15, 2026 · Assigned by GitHub_M

CVE-2026-41181Traefik: Errors middleware forwards Authorization and Cookie headers to separate error page service

Medium 6.9

In plain English

A medium-severity security flaw in traefik from traefik. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.4%top 61.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.44, 3.6.15, and 3.7.0-rc.3, there is an information disclosure vulnerability in Traefik's errors (custom error pages) middleware. When the backend returns a response matching the configured status range, the middleware forwards the original request's complete header set, including Authorization, Cookie, and other authentication material, to the separate error page service rather than only the minimal context needed to render the error page. This behavior is undocumented: the documentation states only that Host is forwarded by default, so operators are not warned that sensitive credentials are shared across service boundaries. Deployments using the errors middleware with a distinct error page service may inadvertently expose end-user credentials to infrastructure that was not intended to receive them. This vulnerability is fixed in 2.11.44, 3.6.15, and 3.7.0-rc.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/traefik/traefik	no fix listed	GO-2026-5532
Go	github.com/traefik/traefik/v2	2.11.44	GHSA-p6hg-qh38-555r
Go	github.com/traefik/traefik/v2	2.11.44	GO-2026-5532
Go	github.com/traefik/traefik/v3	3.6.15	GHSA-p6hg-qh38-555r
Go	github.com/traefik/traefik/v3	3.7.0-rc.3	GHSA-p6hg-qh38-555r
Go	github.com/traefik/traefik/v3	3.6.15, 3.7.0-rc.3	GO-2026-5532

Affected products (as reported)

Vendor	Product	Versions
traefik	traefik	>= 3.7.0-rc.0, < 3.7.0-rc.3>= 3.0.0-beta1, < 3.6.14< 2.11.43

Weakness: CWE-201 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

References

https://github.com/traefik/traefik/security/advisories/GHSA-p6hg-qh38-555r x_refsource_CONFIRM
https://github.com/traefik/traefik/releases/tag/v2.11.44 x_refsource_MISC
https://github.com/traefik/traefik/releases/tag/v3.6.15 x_refsource_MISC
https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.3 x_refsource_MISC