1677 matches found
EUVD-2026-107895
Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client- headers on the plaintext HTTP router. When ssl-redirect is disabled alongside auth-tls-pass-certificate-to-upstream, unauthenticate...
CVE-2026-114640
Traefik versions v3.7.0 before v3.7.14 are affected by an authentication bypass vulnerability in the Kubernetes Ingress-NGINX provider . The issue occurs because the provider forwards client-supplied Ssl-Client-* headers on a plaintext HTTP router. If ssl-redirect is disabled and auth-tls-pass-ce...
CVE-2026-114638
Traefik versions v3.7.0 before v3.7.14 are vulnerable to an improper authentication flaw within the Kubernetes Ingress NGINX provider . The root cause is a name collision during dot-to-dash normalization of auth-tls-secret names, which causes the system to merge client CAs incorrectly. Consequent...
EUVD-2026-107893
Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide after dot-to-dash normalization. Attackers holding certificates from another host's CA can access a host requiring its...
CVE-2026-114636
Traefik version v3.7.13 is vulnerable to an authentication bypass within the Kubernetes Ingress NGINX provider . The root cause is that the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points fails to apply access-control annotations. Consequently, unauthenticated attacker...
EUVD-2026-107892
Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be handed a pooled keep-alive backend...
EUVD-2026-107891
Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations. Unauthenticated attackers reaching the HTTP entr...
CVE-2026-114637
Traefik versions v3.2.0 before v3.7.14 are vulnerable to an authentication bypass within the experimental FastProxy connection pool . The root cause is a failure to pin NTLM/Negotiate-authenticated backend connections to their specific frontend connections. Consequently, unauthenticated clients c...
CVE-2026-114635
Traefik versions prior to v2.11.58 and v3.7.14 are vulnerable to an authentication bypass within the SNI check. The vulnerability occurs because the check is skipped when the request TLS state is nil. On Go 1.27 builds, unauthenticated clients can bypass certificate requirements by sending HTTP/2...
EUVD-2026-107890
Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client...
CVE-2026-54761-poc
CVE-2026-54761: Traefik Kubernetes Gateway crossProviderNamespaces Bypass PoC 日本語版はこちら Description This repository contains a local Proof of Concept PoC for CVE-2026-54761 , a high severity vulnerability in Traefik's Kubernetes Gateway provider. The vulnerability affects the crossProviderNamespac...
VulnCheck KEV: CVE-2026-65600
Traefik versions = v3.6.0 = v3.7.0 = v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator e.g. regex "^/api.", replacement "/$1...
CVE-2026-112778
Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service...
CVE-2026-112778 Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations
Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service...
EUVD-2026-104584
Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service...
CVE-2026-112778 Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations
Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service...
CVE-2026-112778
Traefik versions before 2.11.46 , 3.x before 3.6.17 , and 3.7.0 are vulnerable to a Cross-Namespace Resource Reference in the Kubernetes Ingress provider. The root cause is a lack of namespace validation for Ingress and Service annotations. This allows an attacker with permissions to create or up...
traefik-CVE-2024-45410-poc
Shadow Corp CTF Challenge Welcome to the Shadow Corp Capture the Flag CTF challenge! This challenge will test your skills in identifying and exploiting vulnerabilities related to security headers and HTTP proxy behavior. Your mission is to bypass protections and uncover secrets hidden within the...
CVE-2026-88877-PoC-pwnVader
CVE-2026-88877 — Traefik v3.7.0–v3.7.11 — Authentication bypass via from-to-www-redirect Author: pwnVader · License: MIT repository root | ---|--- Component| Traefik Kubernetes ingress-nginx provider, providers.kubernetesingressnginx Type| CWE-639 — Authorization bypass through user-controlled ke...