CVE-2026-39858

A flaw was found in Traefik. A remote attacker can exploit an authentication bypass vulnerability by injecting spoofed trust context through unsanitized alias headers. This is due to Traefik's forwarded-header sanitization logic not properly handling alias header names that use underscores instea...

CVE-2026-35051

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. This authentication bypass vulnerability exists in Traefik's ForwardAuth middleware when the trustForwardHeader setting is configured as false and Traefik is deployed behind a trusted upstream proxy. A remote attacker could...

CVE-2026-40912

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. This authentication bypass vulnerability allows an unauthenticated attacker to access protected content. The flaw occurs when the StripPrefixRegex middleware is used with authentication mechanisms such as ForwardAuth, BasicAuth...

Traefik < 2.11.44 / 3.x < 3.6.15 Information Disclosure (GHSA-p6hg-qh38-555r)

The version of Traefik installed on the remote macOS host is prior to 2.11.44 or 3.x prior to 3.6.15. It is, therefore, affected by an information disclosure vulnerability: - Traefik's errors middleware forwards Authorization and Cookie headers to separate error page service. CVE-2026-41181 Note...

traefik-3.6.15-1.1 on GA media (moderate)

traefik-3.6.15-1.1 on GA media Announcement ID: openSUSE-SU-2026:10697-1 Rating: moderate Cross-References: CVE-2026-34986 CVE-2026-35051 CVE-2026-39858 CVE-2026-40912 CVE-2026-41174 CVE-2026-41263 CVSS scores: CVE-2026-34986 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-34986...

PT-2026-38531

These are all security issues fixed in the traefik2-2.11.45-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10713-1 traefik-3.6.16-1.1 on GA media

These are all security issues fixed in the traefik-3.6.16-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-38530

These are all security issues fixed in the traefik-3.6.16-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2026-35051

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is an authentication bypass vulnerability in Traefik's ForwardAuth middleware when trustForwardHeader=false is configured and Traefik is deployed behind a trusted upstream proxy. This issu...

SUSE CVE-2026-39858

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's ForwardAuth and snippet-based authentication middleware. Traefik's forwarded-header sanitization logic targets only...

SUSE CVE-2026-41174

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a potential vulnerability in Traefik's Kubernetes CRD provider cross-namespace isolation enforcement. When providers.kubernetesCRD.allowCrossNamespace=false, Traefik correctly rejects...

SUSE CVE-2026-40912

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's StripPrefixRegex middleware when used in combination with ForwardAuth, BasicAuth, or DigestAuth. The middleware matches...

SUSE CVE-2026-41263

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a timing side-channel vulnerability in Traefik's BasicAuth middleware that allows an attacker to enumerate valid usernames through response-time differences. The variable intended to ho...

PT-2026-37372

These are all security issues fixed in the traefik2-2.11.44-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10698-1 traefik2-2.11.44-1.1 on GA media

These are all security issues fixed in the traefik2-2.11.44-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10697-1 traefik-3.6.15-1.1 on GA media

These are all security issues fixed in the traefik-3.6.15-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-37371

These are all security issues fixed in the traefik-3.6.15-1.1 package on the GA media of openSUSE Tumbleweed...

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the errors middleware process. An attacker can obtain sensitive authentication headers, such as Authorization and Cookie, by triggering a backend response that matches the configured...

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the errors middleware process. An attacker can obtain sensitive authentication headers, such as Authorization and Cookie, by triggering a backend response that matches the configured...

Traefik's errors middleware forwards Authorization and Cookie headers to separate error page service

Summary There is a medium severity information disclosure vulnerability in Traefik's errors custom error pages middleware. When the backend returns a response matching the configured status range, the middleware forwards the original request's complete header set, including Authorization, Cookie,...