By vendor

Traefik vulnerabilities

Known CVEs affecting Traefik products, prioritized by severity, with SEC.co remediation and detection guidance.

5 published vulnerabilities

• CVE-2026-54762HIGH 8.6

  Traefik, a widely-used reverse proxy and load balancer, has a flaw in how it handles Kubernetes authentication configuration. When an operator sets up BasicAuth or DigestAuth protection on a route via Kubernetes annotations but the system cannot find or read the required authentication credential (the Secret), Traefik logs the error and then publishes the route anyway—without the authentication protection. This means unauthenticated users can access backends that operators believed were protected. The flaw affects versions 3.7.0-ea.1 through 3.7.4 and is corrected in 3.7.5.

• CVE-2026-54765HIGH 8.5

  Traefik versions 3.7.0 through 3.7.5 contain a filter application bug in the Kubernetes Gateway API provider that can cause requests intended for one HTTPRoute to be processed using a different route's security filters. An attacker with the ability to create HTTPRoutes in a Kubernetes cluster can exploit this to apply their own filter rules (such as injected headers) to legitimate traffic, potentially escalating privileges or accessing data they shouldn't see. The vulnerability requires existing cluster access but can cross namespace boundaries if ReferenceGrants permit it.

• CVE-2023-54365HIGH 7.5

  Traefik, a widely-used API gateway and reverse proxy, is vulnerable to a denial-of-service attack that allows remote attackers to disable the service without authentication. The vulnerability stems from how Traefik handles HTTP/2 connections—attackers can rapidly open and close streams to overwhelm server resources. This flaw was inherited from Go's standard HTTP/2 library and affects Traefik versions before 2.10.5 and 3.0.0-beta4. No special privileges or interaction is required; an attacker on the network can trigger the issue simply by sending crafted HTTP/2 requests.

• CVE-2026-54761HIGH 7.1

  Traefik, a widely-deployed reverse proxy and load balancer, contains a flaw in how it enforces access controls when Kubernetes HTTPRoutes specify multiple backend services. An attacker with the ability to create HTTP routes in a non-allowed namespace can exploit a namespace validation bypass to expose sensitive internal Traefik services—including the admin API, dashboard, and REST interface—to the network. The vulnerability stems from Traefik checking permissions against the wrong namespace when evaluating cross-provider service references, allowing an attacker to pivot through an allow-listed namespace to reach forbidden internal endpoints. This affects versions prior to 3.6.21 and 3.7.5.

• CVE-2026-54764MEDIUM 5.8

  Traefik's ForwardAuth middleware has a header validation flaw that allows attackers to spoof authorization checks. When an attacker sends a specially crafted HTTP request with a fake HTTPS header, Traefik incorrectly forwards a port number (443) to the authentication service—even when the actual connection is plain HTTP. This mismatch can trick the auth service into granting access to users who should be blocked based on port-level restrictions. The vulnerability exists because Traefik uses the attacker-controlled header instead of the actual connection details, bypassing the trustForwardHeader safety setting that administrators may have configured.