TTraefik

Products

Exploited and recent CVEs

• CVE-2026-121966 High 8.7 Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak 0.3%
• CVE-2026-119574 Medium 5.9 Traefik 3.2.0 before 3.7.15 FastProxy Data Race Denial of Service 0.3%
• CVE-2026-119573 Medium 4.4 Traefik 3.7.11 before 3.7.15 Cross-Namespace Authorization Bypass via auth-tls-secret 0.3%
• CVE-2026-119572 High 8.7 Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider 0.2%
• CVE-2026-114656 High 7.5 Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher 0.2%
• CVE-2026-114642 High 8.7 Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper 0.2%
• CVE-2026-114641 Low 3.7 Traefik before 2.11.58 and 3.7.14 Race Condition in NTLM/Kerberos Round Tripper 0.3%
• CVE-2026-114640 High 8.7 Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router 0.2%
• CVE-2026-114639 High 8.7 Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool 0.3%
• CVE-2026-114638 High 8.7 Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision 0.2%
• CVE-2026-114637 High 8.7 Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leak 0.3%
• CVE-2026-114636 High 8.7 Traefik v3.7.13 Authentication Bypass via ssl-passthrough Ingress HTTP Router 0.2%
• CVE-2026-114635 High 8.7 Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme 0.2%
• CVE-2026-112778 Medium 6.4 Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations 0.2%
• CVE-2026-88010 Medium 6.3 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle 0.3%
• CVE-2026-88012 Medium 5.3 Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded 0.5%
• CVE-2026-88011 Medium 5.3 Traefik: ForwardAuth identity spoofing via dot-form header alias 0.4%
• CVE-2026-88009 High 8.8 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging 0.4%
• CVE-2026-88008 High 7.0 Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization 0.5%
• CVE-2026-88007 Critical 9.1 Traefik HTTP/3 Backend NTLM Connection Reuse 0.6%
• CVE-2026-88004 High 7.0 Traefik entrypoint header-name sanitization bypassed via request trailers 0.5%
• CVE-2026-88879 Medium 5.3 Traefik before v2.11.56 Identity Spoofing via Header Alias 0.3%
• CVE-2026-88878 Medium 5.3 Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass 0.4%
• CVE-2026-88877 Critical 9.8 Traefik v3.7.0 Authentication Bypass via from-to-www-redirect 0.6%
• CVE-2026-85597 High 8.2 Traefik before v2.11.55 and v3.0.0 through v3.7.10 mTLS Bypass via TLS Option Conflict 0.4%
• CVE-2026-85596 High 8.2 Traefik v3.7 Authentication Bypass via TLS Option Conflict 0.4%
• CVE-2026-85595 Critical 9.3 Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth 2.5%
• CVE-2026-85594 High 7.0 Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware 0.5%
• CVE-2026-71327 High 7.6 Traefik: Gateway API route identity collision allows cross-namespace backend hijacking 0.5%
• CVE-2026-71326 Low 2.1 Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing 0.3%