Traefik < 2.11.55 / 3.0.0 - 3.7.10 - Digest Authentication Bypass

Traefik 2.11.55 contains an authentication bypass caused by digestAuth middleware returning empty secret for unknown usernames, letting attackers bypass authentication on digestAuth-protected routes without valid credentials. id: CVE-2026-85595 info: name: Traefik 2.11.55 / 3.0.0 - 3.7.10 - Diges...

Traefik - Open Redirect

Traefik before 1.7.26, 2.2.8, and 2.3.0-rc3 contains an open redirect vulnerability in the X-Forwarded-Prefix header. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2020-15129 info: name:...

CVE-2026-54761-poc

CVE-2026-54761: Traefik Kubernetes Gateway crossProviderNamespaces Bypass PoC 日本語版はこちら Description This repository contains a local Proof of Concept PoC for CVE-2026-54761 , a high severity vulnerability in Traefik's Kubernetes Gateway provider. The vulnerability affects the crossProviderNamespac...

authelia

!OpenSSF Scorecardhttps://shieldcn.dev/badge/dynamic/json.svg?url=https://img.shields.io/ossf-scorecard/github.com/authelia/authelia.json&query=$.message&label=openssf%20scorecard&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmc...

CVE-2026-88008-PoC

CVE-2026-88008 — Traefik: unauthorised h2c upgrade tunnels past routers and middleware Affected: Traefik 2.11.26 → 2.11.56 and 3.7.0 → 3.7.12 Fixed: 2.11.57 / 3.7.13 — commit a277e946 "Do not forward h2c upgrade headers to the backend" Advisory: GHSA-w4v4-9rw7-5326 · CVSS 9.1 Class: CWE-444 reque...

traefik-CVE-2024-45410-poc

Shadow Corp CTF Challenge Welcome to the Shadow Corp Capture the Flag CTF challenge! This challenge will test your skills in identifying and exploiting vulnerabilities related to security headers and HTTP proxy behavior. Your mission is to bypass protections and uncover secrets hidden within the...

CVE-2026-88009-PoC

CVE-2026-88009 — Traefik routes an opaque request target as / but forwards it verbatim Affected: Traefik 2.11.57, and 3.0.0 – 3.7.13 Fixed: 2.11.57 / 3.7.13 Fix: commit 58d1e9ca2045 "Deny request with an opaque request target" — denyOpaque in pkg/server/serverentrypointtcp.go Advisory:...

CVE-2026-88877-PoC-pwnVader

CVE-2026-88877 — Traefik v3.7.0–v3.7.11 — Authentication bypass via from-to-www-redirect Author: pwnVader · License: MIT repository root | ---|--- Component| Traefik Kubernetes ingress-nginx provider, providers.kubernetesingressnginx Type| CWE-639 — Authorization bypass through user-controlled ke...

CVE-2026-85595-PoC

CVE-2026-85595 — Traefik digestAuth authenticates unknown users empty secret Affected: Traefik empty secret, not a rejection go-http-auth's CheckAuth then takes that "" as HA1 and computes digest.go:191-203 before the fix: HA1 := da.Secretsauth"username", da.Realm // "" for an unknown user HA2 :=...

traefik-3.7.16-1.1 on GA media (moderate)

traefik-3.7.16-1.1 on GA media Announcement ID: openSUSE-SU-2026:12281-1 Rating: moderate Cross-References: CVE-2026-114635 CVE-2026-114636 CVE-2026-114637 CVE-2026-114638 CVE-2026-114639 CVE-2026-114640 CVE-2026-114641 CVE-2026-114642 CVE-2026-114656 Affected Products: openSUSE Tumbleweed An...

CVE-2026-114641

A flaw was found in Traefik. A remote attacker can exploit a race condition in backend authentication handling by sending concurrent HTTP/2 or HTTP/3 requests over a single connection. This flaw can cause Traefik to crash, resulting in a Denial of Service DoS, or disrupt connection-bound...

GO-2026-6880 vulnerabilities

Vulnerabilities for packages: traefik, sigstore-scaffolding, kserve, tekton-pipelines...

GO-2026-6865 vulnerabilities

Vulnerabilities for packages: crane, docker, pulumi, keda, spire-server, azcopy, terragrunt, vcluster, sqlexporter, dagger, kubescape-operator, grafana, harbor-registry, traefik, vault-secrets-webhook, verticadb-operator, conftest, local-path-provisioner, vexctl, flux-image-reflector-controller,...

GO-2026-6880 vulnerabilities

Vulnerabilities for packages: kserve-localmodelnode-agent, kserve, traefik, sigstore-scaffolding, tekton-pipelines, kserve-localmodelnode-agent-fips, sigstore-scaffolding-fips, tekton-pipelines-fips, traefik-fips, kserve-fips...

GO-2026-6865 vulnerabilities

Vulnerabilities for packages: grafana-postgresql-datasource, longhorn-manager-fips, step-ca, kwok, tekton-pipelines, dive, grafana-zipkin-datasource, haproxy-ingress, kaniko, google-cloud-otel-ops-collector, agentbeat, apm-server-fips, newrelic-fluent-bit-output, harbor-scanner-trivy,...

CVE-2026-116591 vulnerabilities

Vulnerabilities for packages: crane, docker, pulumi, keda, spire-server, azcopy, terragrunt, vcluster, sqlexporter, dagger, kubescape-operator, grafana, harbor-registry, traefik, vault-secrets-webhook, verticadb-operator, conftest, local-path-provisioner, vexctl, flux-image-reflector-controller,...

GHSA-FPMH-FRQ8-7RJ8 vulnerabilities

Vulnerabilities for packages: crane, docker, pulumi, keda, spire-server, azcopy, terragrunt, vcluster, sqlexporter, dagger, kubescape-operator, grafana, harbor-registry, traefik, vault-secrets-webhook, verticadb-operator, conftest, local-path-provisioner, vexctl, flux-image-reflector-controller,...

CVE-2026-119574

A flaw was found in Traefik. A race condition in the FastProxy component allows an unauthenticated remote attacker to cause a Denial of Service DoS. By repeatedly opening and aborting upgraded protocol connections, such as WebSockets, an attacker can corrupt shared internal buffers, triggering a...

CVE-2026-119573

A flaw was found in Traefik. An authorization bypass vulnerability exists in the Kubernetes Ingress NGINX provider when cached client authentication Transport Layer Security TLS configurations are reused. An authenticated user with permissions to create Ingress resources can bypass cross-namespac...

CVE-2026-121966

A flaw was found in Traefik. The ForwardAuth middleware routes authentication requests through a connection pool shared across all clients, failing to isolate connection-bound authentication protocols such as NT LAN Manager NTLM or Negotiate. An unauthenticated remote attacker could exploit this...