131 matches found
Traefik - Authentication Bypass - Version Detection
Traefik versions = v3.0.0 = v3.7.0 = v3.0.0 = v3.7.0 = v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware CVE-2026-65600. This template passively identifies vulnerable versions by reading the version reported on the Traefik API /api/version, which is...
CVE-2026-121966
A flaw was found in Traefik. The ForwardAuth middleware routes authentication requests through a connection pool shared across all clients, failing to isolate connection-bound authentication protocols such as NT LAN Manager NTLM or Negotiate. An unauthenticated remote attacker could exploit this...
SUSE CVE-2026-121966
Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests and, in 3.7, Ingress NGINX auth-url requests through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user'...
CVE-2026-121966
Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests and, in 3.7, Ingress NGINX auth-url requests through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user'...
EUVD-2026-116966
Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests and, in 3.7, Ingress NGINX auth-url requests through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user'...
CVE-2026-121966
Traefik versions 2.x before 2.11.60 and 3.x before 3.7.16 are vulnerable to an identity leak during ForwardAuth and Ingress NGINX auth-url requests. The root cause is that these subrequests are sent through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Ne...
CVE-2026-121966 Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak
Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests and, in 3.7, Ingress NGINX auth-url requests through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user'...
CVE-2026-121966 Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak
Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests and, in 3.7, Ingress NGINX auth-url requests through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user'...
PT-2026-137018
Name of the Vulnerable Software and Affected Versions Traefik versions 2.x through 2.11.59 Traefik versions 3.x through 3.7.15 Description ForwardAuth subrequests and Ingress NGINX auth-url requests are sent through an auth-server connection pool shared by all clients. This behavior exposes...
CVE-2026-121966: traefik: Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url…
Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests and, in 3.7, Ingress NGINX auth-url requests through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user'...
Exploit for Improper Validation of Syntactic Correctness of Input in Traefik
CVE-2026-88009 — Traefik routes an opaque request target as /...
FreeBSD : traefik -- ForwardAuth vulnerability (67ba2e09-cff9-11f1-a264-5404a68ad561)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 67ba2e09-cff9-11f1-a264-5404a68ad561 advisory. The traefik project releases a new version addressing ForwardAuth vulnerabilities: Tenable has extracte...
traefik -- ForwardAuth vulnerability
The traefik project releases a new version addressing ForwardAuth vulnerabilities: GHSA-hrpp-p4fc-wwf8 ForwardAuth leaking NTLM/Negotiate-bound identity across clients...
SUSE CVE-2026-88011
Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User...
GO-2026-6455 Traefik: ForwardAuth identity spoofing via dot-form header alias in github.com/traefik/traefik
Traefik: ForwardAuth identity spoofing via dot-form header alias in github.com/traefik/traefik...
SUSE CVE-2026-88879
Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so X-Auth-User, XAuthUser and X.Auth.User are treated as three distinct headers by Traefik, while backends that derive variable...
GHSA-RF44-J88R-HH8C Traefik: ForwardAuth identity spoofing via dot-form header alias
Summary There is a medium severity vulnerability in Traefik's handling of request headers whose name aliases another header name. Go canonicalizes header names on dashes only, so X-Auth-User, XAuthUser and X.Auth.User are three distinct headers to Traefik, while backends that derive variable name...
Traefik: ForwardAuth identity spoofing via dot-form header alias
Summary There is a medium severity vulnerability in Traefik's handling of request headers whose name aliases another header name. Go canonicalizes header names on dashes only, so X-Auth-User, XAuthUser and X.Auth.User are three distinct headers to Traefik, while backends that derive variable name...
CVE-2026-88011
Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User...
CVE-2026-88011 Traefik: ForwardAuth identity spoofing via dot-form header alias
Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User...