WS-2026-0138

github.com/traefik/traefik/v3 v3.2.0-rc1 - v3.7.13: experimental FastProxy connection pool shares NTLM/Negotiate-authenticated backend connections across frontend connections, letting an unauthenticated client act as the victim GHSA-53qr-784g-cj35...

WS-2026-0148

github.com/traefik/traefik/v2 v2.6.1 - v2.11.57, github.com/traefik/traefik/v3 v3.0.0-beta1 - v3.7.13: the SNI check is skipped when a request carries no TLS state HTTP/2 :scheme http over TLS with Go 1.27 builds, so a router requiring a client certificate can be reached without one...

WS-2026-0159

github.com/traefik/traefik/v3 v3.7.0-rc.1 - v3.7.13: the Ingress-NGINX provider does not strip client-supplied Ssl-Client- headers on the plaintext HTTP router of an auth-tls-pass-certificate-to-upstream Ingress, so a client can forge an mTLS identity for the backend GHSA-mwrr-6hp4-pxr6...

WS-2026-0145

github.com/traefik/traefik/v2 v2.11.0 - v2.11.57, github.com/traefik/traefik/v3 v3.0.0-rc1 - v3.7.13: the connection-scoped NTLM/Kerberos sticky round tripper is not keyed by ServersTransport, so one service's TLS client configuration is applied to another service's backend GHSA-cw35-4q88-3rmp...

WS-2026-0163

github.com/traefik/traefik/v3 v3.7.13: the Ingress-NGINX provider builds the HTTP router of an ssl-passthrough Ingress without its auth and allow-list annotations, exposing the protected backend without authentication GHSA-qvj7-gq9c-hp7q...

WS-2026-0162

github.com/traefik/traefik/v2 v2.11.0 - v2.11.57, github.com/traefik/traefik/v3 v3.0.0-rc1 - v3.7.13: a preauthenticated NTLM/Negotiate request authenticates a backend connection in the globally shared pool, which another unauthenticated client can then reuse with the victim's identity...

WS-2026-0165

github.com/traefik/traefik/v3 v3.7.0-rc.1 - v3.7.13: the Ingress-NGINX provider normalizes dots to dashes in generated auth-tls TLS option names, so colliding Secret names merge two client CAs and a host is gated by another host's CA GHSA-rv2h-qh7j-xrjw...

GO-2026-6615 vulnerabilities

Vulnerabilities for packages: grafana, traefik, kubescape, kubescape-operator...

GHSA-HJF4-FPHR-2H65 vulnerabilities

Vulnerabilities for packages: grafana, traefik, kubescape, kubescape-operator...

CVE-2026-81872 vulnerabilities

Vulnerabilities for packages: grafana, traefik, kubescape, kubescape-operator...

GO-2026-6558 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...

PT-2026-105579

Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...

Exploit for Incorrect Authorization in Traefik

CVE-2026-88008 — Traefik: unauthorised h2c upgrade tunnels pas...

Exploit for Authorization Bypass Through User-Controlled Key in Traefik

CVE-2026-88877 — Traefik v3.7.0–v3.7.11 — Authentication b...

CVE-2026-88010

creationtimestamp| type| source ---|---|--- 2026-09-22 22:35:06+00:00| published-proof-of-concept| https://github.com/traefik/traefik/security/advisories/GHSA-8fcf-v89g-xpg6 2026-09-22 23:31:56+00:00| seen| https://gist.github.com/alon710/af64fb0e4974981b0997528347311521 2026-09-23 00:00:39+00:00...

GHSA-8FCF-V89G-XPG6 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

Summary Traefik's BasicAuth middleware coalesces concurrent credential checks through a singleflight.Group to avoid hashing the same password many times at once. Since v3.6.11 the deduplication key was built from the submitted password plus the stored secret, so it depended on server state: a...

Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

Summary Traefik's BasicAuth middleware coalesces concurrent credential checks through a singleflight.Group to avoid hashing the same password many times at once. Since v3.6.11 the deduplication key was built from the submitted password plus the stored secret, so it depended on server state: a...

CVE-2026-88011

A flaw was found in Traefik, an open-source HTTP reverse proxy and load balancer. A remote attacker can exploit this vulnerability by sending a specially crafted dot-form header, such as X.Authenticated.User. Due to a discrepancy in how Go and certain backend systems like CGI, WSGI, PHP, and NGIN...

CVE-2026-88010

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basicauth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames therefore coalesce on one...

CVE-2026-88004

A flaw was found in Traefik, an open-source HTTP reverse proxy and load balancer. Its entrypoint defenses, designed to sanitize header names, failed to inspect request trailers. This allowed an unauthenticated client to submit malicious header names within HTTP/1.1 chunked or HTTP/2 trailers...