PT-2026-89390

Name of the Vulnerable Software and Affected Versions Traefik versions 1.x Traefik versions 2.x through 2.11.55 Traefik versions 3.0.0 through 3.7.11 Description Traefik handles request header canonicalization only on dashes, meaning it treats headers like X-Auth-User, X Auth User, and X.Auth.Use...

Traefik < 2.11.43 / 3.x < 3.6.14 Multiple Vulnerabilities

The version of Traefik installed on the remote macOS host is prior to 2.11.43 or 3.x prior to 3.6.14. It is, therefore, affected by multiple vulnerabilities: - An authentication bypass via StripPrefixRegex and ForwardAuth dot-segment normalization. When StripPrefixRegex processes URLs with...

CVE-2026-35051

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is an authentication bypass vulnerability in Traefik's ForwardAuth middleware when trustForwardHeader=false is configured and Traefik is deployed behind a trusted upstream proxy. This issu...