authelia

!OpenSSF Scorecardhttps://shieldcn.dev/badge/dynamic/json.svg?url=https://img.shields.io/ossf-scorecard/github.com/authelia/authelia.json&query=$.message&label=openssf%20scorecard&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmc...

Traefik - Open Redirect

Traefik before 1.7.26, 2.2.8, and 2.3.0-rc3 contains an open redirect vulnerability in the X-Forwarded-Prefix header. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2020-15129 info: name:...

traefik-CVE-2024-45410-poc

Shadow Corp CTF チャレンジ Shadow Corp Capture the Flag CTF チャレンジへようこそ！このチャレンジでは、セキュリティヘッダーやHTTPプロキシの動作に関する脆弱性の特定と悪用のスキルをテストします。あなたのミッションは、保護を回避し、Shadow Corp Webアプリケーションに隠された秘密を明らかにすることです。 ストーリー あなたは、秘密のサイバースパイ活動に関与している悪名高い組織Shadow...

GO-2026-6558 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...

traefik-stripprefix-auth-bypass-cve-2026-48020-path-normalization

CVE-2026-48020 — Traefik StripPrefix ルートレベル認証バイパス PoC CVE-2026-48020 の自己完結型Proof of Concept PoCです。これは、ルーティング決定が行われた後 にパス正規化が発生することにより、TraefikのStripPrefixミドルウェアでルートレベルの認証/認可バイパスが発生する脆弱性です。 例えばGET /api../adminのようなリクエストは、ルーティング時に パブリック...

Exploit for Incorrect Authorization in Traefik

CVE-2026-88008 — Traefik: unauthorised h2c upgrade tunnels pas...

CVE-2026-54761-poc

CVE-2026-54761: Traefik Kubernetes Gateway crossProviderNamespaces Bypass PoC English version 概要 このリポジトリは、Traefik の Kubernetes Gateway provider に存在する高深刻度の脆弱性 CVE-2026-54761 を、ローカル環境で再現するための Proof of Concept PoC です。 この脆弱性は crossProviderNamespaces の許可リストに影響します。複数の重み付きバックエンド参照を宣言する HTTPRoute...

CVE-2026-88877-PoC-pwnVader

CVE-2026-88877 — Traefik v3.7.0–v3.7.11 — 通过 from-to-www-redirect 实现的认证绕过 作者： pwnVader · 许可证： MIT（仓库根目录） | ---|--- 组件| Traefik（Kubernetes ingress-nginx provider，providers.kubernetesingressnginx） 类型| CWE-639 — 通过用户可控键实现的授权绕过 受影响版本| Traefik = v3.7.0, 披露状态。 该漏洞由 Traefik 项目公开披露，并已在 v3.7.12...

Exploit for Authorization Bypass Through User-Controlled Key in Traefik

CVE-2026-88877 — Traefik v3.7.0–v3.7.11 — Authentication b...

CVE-2026-88010

creationtimestamp| type| source ---|---|--- 2026-09-22 22:35:06+00:00| published-proof-of-concept| https://github.com/traefik/traefik/security/advisories/GHSA-8fcf-v89g-xpg6 2026-09-22 23:31:56+00:00| seen| https://gist.github.com/alon710/af64fb0e4974981b0997528347311521 2026-09-23 00:00:39+00:00...

Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

Summary Traefik's BasicAuth middleware coalesces concurrent credential checks through a singleflight.Group to avoid hashing the same password many times at once. Since v3.6.11 the deduplication key was built from the submitted password plus the stored secret, so it depended on server state: a...

GHSA-8FCF-V89G-XPG6 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

Summary Traefik's BasicAuth middleware coalesces concurrent credential checks through a singleflight.Group to avoid hashing the same password many times at once. Since v3.6.11 the deduplication key was built from the submitted password plus the stored secret, so it depended on server state: a...

CVE-2026-88011

A flaw was found in Traefik, an open-source HTTP reverse proxy and load balancer. A remote attacker can exploit this vulnerability by sending a specially crafted dot-form header, such as X.Authenticated.User. Due to a discrepancy in how Go and certain backend systems like CGI, WSGI, PHP, and NGIN...

CVE-2026-88010

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basicauth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames therefore coalesce on one...

CVE-2026-88004

A flaw was found in Traefik, an open-source HTTP reverse proxy and load balancer. Its entrypoint defenses, designed to sanitize header names, failed to inspect request trailers. This allowed an unauthenticated client to submit malicious header names within HTTP/1.1 chunked or HTTP/2 trailers...

CVE-2026-88012

A flaw was found in Traefik, an open-source HTTP reverse proxy and load balancer. Its HTTP/3 entrypoints do not correctly apply read timeouts, which are intended to prevent prolonged connections. An unauthenticated client can exploit this by sending a slow request body, continuously trickling dat...

CVE-2026-88008

A flaw was found in Traefik, an open source HTTP reverse proxy and load balancer. A remote unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP/2 request that includes specific upgrade headers. If the backend server accepts the upgrade, Traefik enters a raw...

CVE-2026-88007

A flaw in Traefik's HTTP/3 ConnContext allows unauthenticated remote attackers to bypass authentication on backends using connection-bound NTLM or Negotiate protocols. Missing service.AddTransportOnContext calls lead to shared kerberosRoundTripper transports, enabling attackers to hijack persiste...

CVE-2026-88010

Traefik (open source HTTP reverse proxy and load balancer) versions 3.6.11 through before 3.7.13 contain an unauthenticated username-enumeration timing oracle in the BasicAuth middleware. The checkPassword function in pkg/middlewares/auth/basic_auth.go constructs the singleflight key from the sub...

EUVD-2026-84532

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basicauth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames therefore coalesce on one...