1336 matches found
Traefik - Open Redirect
Traefik before 1.7.26, 2.2.8, and 2.3.0-rc3 contains an open redirect vulnerability in the X-Forwarded-Prefix header. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2020-15129 info: name:...
authelia
Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on SSO for your applications via a web portal. It acts as a companion for reverse proxies by allowing, denying, or redirecting requests. Documentation is available at...
traefik-CVE-2024-45410-poc
Shadow Corp CTF 挑战赛 欢迎参加 Shadow Corp 夺旗赛 CTF 挑战！本次挑战将测试您在识别和利用与安全标头及 HTTP 代理行为相关的漏洞方面的技能。您的任务是绕过保护措施，并揭露隐藏在 Shadow Corp 网络应用程序中的秘密。 故事 您发现了 Shadow Corp 的公共 Web 界面，这是一个以从事秘密网络间谍活动而臭名昭著的组织。有传言称，他们保护了一个只有内部可信人员才能访问的端点。然而，有传闻说，只要使用正确的方法，您可以欺骗系统，让其暴露这个隐藏的端点，从而揭露 Shadow Corp 的秘密。 您的任务：访问受保护的端点并获取隐藏的旗帜！...
CVE-2026-88877
A flaw was found in Traefik's Kubernetes ingress-nginx provider. A remote attacker, by sending a specially crafted request with a malformed Host header e.g., containing a non-numeric port, can bypass security middlewares, including authentication and IP allowlisting. This leads to unauthorized...
CVE-2026-88879
A flaw was found in Traefik, an HTTP reverse proxy and load balancer. Due to a discrepancy in how Traefik and certain backend applications process HTTP header names, a remote attacker can smuggle specially crafted headers. This allows the attacker to bypass identity assertions made by Traefik,...
CVE-2026-85594
A flaw was found in Traefik. The software fails to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation within the Kubernetes Ingress provider. This vulnerability allows a namespace-limited tenant, even if excluded from the...
CVE-2026-85596
A flaw was found in Traefik. This vulnerability allows a remote attacker to bypass authentication, gaining unauthorized access to protected routes. This occurs due to a conflict in how Traefik handles Transport Layer Security TLS options when specific Kubernetes Ingress objects are configured. Th...
CVE-2026-67309
A flaw was found in Traefik. This path traversal vulnerability exists in the Kubernetes Ingress NGINX provider's RewriteTarget middleware. A remote attacker can craft a special request that uses dot-segment traversal to bypass authentication mechanisms like BasicAuth, DigestAuth, or ForwardAuth...
CVE-2026-88004
creationtimestamp| type| source ---|---|--- 2026-09-11 00:35:05+00:00| published-proof-of-concept| https://github.com/traefik/traefik/security/advisories/GHSA-v67p-phpq-fc8x...
CVE-2026-88008
creationtimestamp| type| source ---|---|--- 2026-09-11 00:35:03+00:00| published-proof-of-concept| https://github.com/traefik/traefik/security/advisories/GHSA-w4v4-9rw7-5326...
Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization
Summary There is a high-severity request-smuggling vulnerability in Traefik's handling of the HTTP/1.1 Upgrade mechanism. Since Traefik moved to unencrypted HTTP/2 with prior knowledge Go 1.24, a client-initiated Upgrade: h2c request header and its connection-specific HTTP2-Settings header were...
GHSA-W4V4-9RW7-5326 Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization
Summary There is a high-severity request-smuggling vulnerability in Traefik's handling of the HTTP/1.1 Upgrade mechanism. Since Traefik moved to unencrypted HTTP/2 with prior knowledge Go 1.24, a client-initiated Upgrade: h2c request header and its connection-specific HTTP2-Settings header were...
GHSA-V67P-PHPQ-FC8X Traefik entrypoint header-name sanitization bypassed via request trailers
Summary Traefik's entrypoint defenses against spoofed trusted header names — aliasHeadersStrategy / underscoreHeadersStrategy in delete or reject mode, and the default forwardedHeaders stripping of client-supplied X-Forwarded- — scan req.Header only and never req.Trailer. An unauthenticated clien...
Traefik entrypoint header-name sanitization bypassed via request trailers
Summary Traefik's entrypoint defenses against spoofed trusted header names — aliasHeadersStrategy / underscoreHeadersStrategy in delete or reject mode, and the default forwardedHeaders stripping of client-supplied X-Forwarded- — scan req.Header only and never req.Trailer. An unauthenticated clien...
Traefik HTTP/3 Backend NTLM Connection Reuse
Summary Traefik's HTTP/3 request path did not initialize the connection-scoped backend transport holder that isolates connection-bound NTLM and Negotiate Kerberos authentication on the HTTP/1.1 and HTTP/2 paths. The HTTP/3 entrypoint reuses the HTTPS handler chain and reaches the same backend...
GHSA-QQJF-53CJ-PWVV Traefik HTTP/3 Backend NTLM Connection Reuse
Summary Traefik's HTTP/3 request path did not initialize the connection-scoped backend transport holder that isolates connection-bound NTLM and Negotiate Kerberos authentication on the HTTP/1.1 and HTTP/2 paths. The HTTP/3 entrypoint reuses the HTTPS handler chain and reaches the same backend...
GHSA-F52W-8J3H-J724 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
Summary Traefik accepts an HTTP/1.x request whose request-target is in rootless / opaque form for example GET http:http://internal-vhost/admin HTTP/1.1. Go parses this into URL.Opaque with an empty URL.Path, so Traefik evaluates all routing, path-sanitization, middleware and access-log decisions...
Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
Summary Traefik accepts an HTTP/1.x request whose request-target is in rootless / opaque form for example GET http:http://internal-vhost/admin HTTP/1.1. Go parses this into URL.Opaque with an empty URL.Path, so Traefik evaluates all routing, path-sanitization, middleware and access-log decisions...