EUVD-2026-75578
GHSA-f52w-8j3h-j724
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service HTTP request consistency
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 10, 2026
HTTP/1 request-target parsing in Traefik prior to 2.11.57 and 3.7.13 allows unauthenticated remote attackers to send a rootless URL target (e.g., http:example.com/admin) that Go's HTTP library stores in URL.Opaque rather than URL.Path, leaving URL.Path empty. Traefik's routing engine, forwardAuth middleware, and access logger all evaluate against the normalized empty path (treated as /), while URL.RequestURI() gives URL.Opaque precedence when forwarding — meaning the backend receives the original opaque target verbatim. The practical consequence is cross-vhost routing bypass, path-scoped authorization bypass, and access-log evasion, all requiring no authentication or special client configuration. No public exploit has been identified at time of analysis, though the patch PR includes test cases demonstrating the attack technique in full detail.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Traefik gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evaluates routing, path sanitization, forwardAuth, encodedCharacters, and access logging against a path normalized to / but forwards URL.Opaque verbatim to the backend, allowing cross-vhost routing bypass, path-scoped authorization bypass, and access-log evasion when the backend interprets the opaque target as a path. This issue is fixed in 2.11.57 and 3.7.13.
Technical POC Analysis
CWE-444 (inconsistent interpretation of HTTP requests).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Traefik reverse-proxy versions prior to 2.11.57 (v2.x) and 3.7.13 (v3.x) contain an HTTP parsing flaw allowing unauthenticated attackers to bypass path-based routing policies and authorization controls; no public exploit identified at time of analysis. Organizations using Traefik for API gateways or multi-tenant load balancing face direct risk of unauthorized cross-service access and compliance violations through access-log evasion.
Within 24 hours: inventory all Traefik deployments and identify instances running versions before 2.11.57 or 3.7.13 to determine patch scope. Within 7 days: upgrade all affected instances to Traefik 2.11.57 or later (v2.x stream) or 3.7.13 or later (v3.x stream), testing thoroughly in staging first to validate route configurations and middleware behavior. Within 30 days: audit backend service access logs for indicators of exploitation such as requests with rootless URL targets (e.g., http:example.com/path) or anomalous cross-vhost traffic, and validate that authorization policies are correctly enforced post-upgrade.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
HTTP request smuggling exploits inconsistencies in how front-end and back-end servers parse HTTP message boundaries.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Authentication bypass in Traefik reverse proxy before v2.11.55 lets remote unauthenticated attackers defeat any route pr
Backend connection hijacking in Traefik reverse proxy (2.11.0 through 2.11.56 and 3.0.0 through 3.7.12) lets an unauthen
Authentication bypass in the Traefik reverse proxy (v2.11.51 and earlier, v3.6.0-v3.6.22, and v3.7.0-v3.7.6) allows unau
Route-level authentication bypass in Traefik v3.7.0-v3.7.7 allows unauthenticated remote attackers to reach backend endp
Traefik is an open source HTTP reverse proxy and load balancer. Rated high severity (CVSS 7.5), this vulnerability is re
types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable
Security middleware bypass in Traefik reverse proxy versions 2.11.26-2.11.56 and 3.4.2-3.7.12 allows unauthenticated net
Traefik's header-security defenses (aliasHeadersStrategy, underscoreHeadersStrategy, forwardedHeaders) inspect req.Heade
Path normalization bypass in Traefik allows unauthenticated remote attackers to circumvent the middleware chain on path-
Traefik is an open source HTTP reverse proxy and load balancer. Rated medium severity (CVSS 6.5), this vulnerability is
Traefik is an open source HTTP reverse proxy and load balancer. Rated medium severity (CVSS 6.5), this vulnerability is
Exploit-DB