Traefik
Monthly
HTTP/1 request-target parsing in Traefik prior to 2.11.57 and 3.7.13 allows unauthenticated remote attackers to send a rootless URL target (e.g., `http:example.com/admin`) that Go's HTTP library stores in URL.Opaque rather than URL.Path, leaving URL.Path empty. Traefik's routing engine, forwardAuth middleware, and access logger all evaluate against the normalized empty path (treated as `/`), while URL.RequestURI() gives URL.Opaque precedence when forwarding — meaning the backend receives the original opaque target verbatim. The practical consequence is cross-vhost routing bypass, path-scoped authorization bypass, and access-log evasion, all requiring no authentication or special client configuration. No public exploit has been identified at time of analysis, though the patch PR includes test cases demonstrating the attack technique in full detail.
Security middleware bypass in Traefik reverse proxy versions 2.11.26-2.11.56 and 3.4.2-3.7.12 allows unauthenticated network attackers to reach protected backend routes by exploiting h2c protocol upgrade tunneling. When a crafted HTTP/1.1 request carrying Connection, Upgrade: h2c, and HTTP2-Settings headers causes a h2c-capable backend to respond with 101 Switching Protocols, Traefik enters a raw TCP tunnel that silently disables every configured middleware layer-including BasicAuth, ForwardAuth, IPAllowList, RateLimit, and all access logging, metrics, and tracing hooks-for the lifetime of that connection. All subsequent HTTP/2 frames in the tunnel reach protected backend paths without any Traefik security enforcement. No public exploit code has been identified at time of analysis; vendor-released fixes are available in v2.11.57 and v3.7.13.
Backend connection hijacking in Traefik reverse proxy (2.11.0 through 2.11.56 and 3.0.0 through 3.7.12) lets an unauthenticated remote client impersonate another user over HTTP/3. Because the HTTP/3 entrypoint never calls service.AddTransportOnContext, the kerberosRoundTripper falls back to a shared backend transport instead of one bound to each frontend connection, so when a backend uses connection-bound NTLM or Negotiate authentication with keep-alive, an unrelated client can reuse a backend connection already authenticated for a victim, read the victim's data, and act as the victim without ever obtaining their credentials. No public exploit is identified at time of analysis, though the fix PR ships a regression test that effectively demonstrates the flaw.
Traefik's header-security defenses (aliasHeadersStrategy, underscoreHeadersStrategy, forwardedHeaders) inspect req.Header but not req.Trailer, allowing unauthenticated clients on versions 3.2.0 through 3.7.12 to smuggle security-sensitive header values through HTTP/1.1 chunked trailers or HTTP/2 trailers. When retry or buffering middleware is active in the routing chain, attacker-controlled trailer values become accessible before the request is cloned for the backend; backends that merge trailers into their header namespace then receive the spoofed values, bypassing Traefik's documented delete or reject behavior. No public exploit code has been identified and this CVE is not in CISA KEV, but the impact on identity and routing integrity at the backend is classified high by the CVSS 4.0 subsequent-system metrics.
Authentication bypass in Traefik v3.7.0 through v3.7.11 lets remote unauthenticated attackers reach protected Kubernetes backends when an Ingress uses the ingress-nginx compatibility provider with both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. The provider generates a host-only 'sibling' router carrying only a non-terminal RedirectRegex middleware that still routes to the protected backend, so a crafted request evades the redirect and is proxied without any annotation-derived middleware. Reported by VulnCheck with a published advisory; no public exploit is identified at time of analysis, though the technique is fully documented and trivially reproducible.
Client-certificate authentication (mTLS) in Traefik before v2.11.55 can be silently bypassed by unauthenticated network attackers when routers are configured with multiple hostnames bearing conflicting TLS options. Traefik's conflict resolution logic incorrectly falls back to default (non-mTLS) TLS settings for all hostnames in the affected multi-host router, allowing an attacker to reach mTLS-protected backends without presenting a valid client certificate. No public exploit code or CISA KEV listing has been identified; the CVSS 4.0 AT:P metric confirms that exploitation depends on a specific deployment configuration being present.
Client certificate authentication bypass in Traefik v3.7.0-v3.7.10 allows unauthenticated network clients to reach services protected by the nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" annotation without presenting a valid mTLS client certificate. The flaw stems from a naming collision in the Kubernetes Ingress NGINX provider: when two Ingress objects share the same host, client CA secret, and authentication mode, Traefik's conflict-resolution logic silently falls back to the entry point's default TLS configuration, which imposes no client certificate requirement. No public exploit has been identified at time of analysis, and the issue is fixed in Traefik v3.7.11.
Authentication bypass in Traefik reverse proxy before v2.11.55 lets remote unauthenticated attackers defeat any route protected by the digestAuth middleware. The flaw stems from the middleware returning an empty secret for unknown usernames rather than rejecting them, so an attacker can craft a mathematically valid digest response from that empty secret and arbitrary credentials. Reported by VulnCheck with a fix in v2.11.55; no public exploit identified at time of analysis, though the trivial nature of the bypass makes weaponization straightforward.
Traefik's Kubernetes Ingress provider, starting from v3.7.1, incorrectly fails to enforce crossProviderNamespaces namespace-isolation controls on the traefik.ingress.kubernetes.io/service.middlewares Service annotation. A low-privileged tenant scoped to their own Kubernetes namespace can attach an operator-owned middleware from a namespace they are not permitted to reference, and if that middleware injects authentication credentials into backend requests, the attacker can exfiltrate those credentials via a backend endpoint under their control. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Route-level authentication bypass in Traefik v3.7.0-v3.7.7 allows unauthenticated remote attackers to reach backend endpoints protected by BasicAuth, DigestAuth, or ForwardAuth by exploiting unnormalized dot-segment paths generated by the Kubernetes Ingress NGINX provider's RewriteTarget middleware. When an Ingress path regex captures attacker-controlled text without requiring a path separator (e.g., /api(.*) rewriting to /$1), a crafted request such as /api../admin is rewritten to /../admin and forwarded to a backend that resolves it to /admin - a path secured on a separate Traefik router - entirely bypassing route-level access controls. No public exploit has been identified at time of analysis; a vendor patch is available in v3.7.8.
Authentication bypass in the Traefik reverse proxy (v2.11.51 and earlier, v3.6.0-v3.6.22, and v3.7.0-v3.7.6) allows unauthenticated remote attackers to reach protected backend routes by abusing the ReplacePathRegex middleware. When the middleware rewrites a path using a capture group lacking a mandatory separator, a crafted request such as GET /api../admin yields an un-normalized path (/../admin) that the middleware forwards without re-validation; a normalizing backend then resolves it to a protected route, skipping any auth middleware bound to that path. No public exploit identified at time of analysis, and no EPSS/KEV data was supplied, but the flaw is trivially reproducible from the advisory's own example.
Identity/authorization header spoofing in Traefik reverse proxy (before v2.11.51, v3.6.22, and v3.7.6) lets an attacker reaching a protected route smuggle an underscore-variant HTTP header past the BasicAuth, DigestAuth, and ForwardAuth middlewares' sanitization. Traefik strips canonical dashed spoofed headers before setting its own trusted value but ignores underscore forms (e.g. X_Forwarded_User vs X-Forwarded-User) that many backends normalize identically, so the forged header reaches the backend alongside — or, on the ForwardAuth authResponseHeaders path, instead of — Traefik's intended value. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but a vendor fix and upstream commit are published.
Traefik reverse proxy and load balancer contains an mTLS authentication bypass vulnerability that allows attackers to circumvent mutual TLS certificate requirements by sending fragmented TLS ClientHello packets. Affected versions include Traefik 2.11.40 and below, 3.0.0-beta1 through 3.6.10, and 3.7.0-ea.1. When ClientHello messages are fragmented across multiple TLS records, SNI extraction fails with an EOF error, causing the TCP router to fall back to default TLS configuration without client certificate validation, enabling unauthorized access to services that should require mTLS authentication.
Traefik versions 2.11.9-2.11.37 and 3.1.3-3.6.8 contain a case-sensitivity bypass in Connection header handling that allows unauthenticated remote attackers to remove critical X-Forwarded headers by using lowercase Connection tokens, potentially enabling header spoofing attacks. An attacker can exploit this to manipulate forwarded client information such as IP addresses and hostnames, compromising the integrity of upstream application data. A patch is available for affected versions.
Traefik versions before 2.11.38 and 3.6.9 allow remote attackers to cause denial of service by sending incomplete TLS records to TCP routers, which causes the TLS handshake process to hang indefinitely while holding connections open. An unauthenticated attacker can exploit this by opening many stalled connections in parallel to exhaust file descriptors and goroutines, degrading or disabling the proxy service.
Denial of service in Traefik versions prior to 3.6.8 allows unauthenticated remote attackers to exhaust connection resources by exploiting improper timeout handling in STARTTLS request processing. An attacker can send a PostgreSQL SSLRequest prelude and then stall the connection indefinitely, bypassing the readTimeout protection and accumulating open connections until service availability is degraded. A patch is available in version 3.6.8.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
HTTP/3 read timeout non-enforcement in Traefik allows unauthenticated remote attackers to exhaust upstream backend connection pools by trickling request body data indefinitely over QUIC streams. Versions 2.8.2 through 2.11.55 and 3.x through 3.7.11 fail to apply the configured `readTimeout` to HTTP/3 entrypoints because that timeout is enforced at the TCP connection layer and QUIC streams have no corresponding deadline. Attackers with access to an exposed HTTP/3 endpoint can hold upstream connections open without triggering any server-side timeout, progressively exhausting backends with bounded connection pools. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.
ForwardAuth identity spoofing in Traefik allows authenticated network users to impersonate arbitrary identities on normalization-prone backends by sending dot-form HTTP headers (e.g., X.Authenticated.User) that Go's net/http layer treats as distinct from their dash-form equivalents (X-Authenticated-User), while CGI, WSGI, PHP, and NGINX backends collapse both into the same environment variable. Affected deployments span the 2.x branch below v2.11.56 and the 3.x branch from 3.0.0 through 3.7.12; the protective aliasHeadersStrategy option defaults to keep, meaning all unpatched deployments with ForwardAuth and normalization-prone backends are exposed without any additional misconfiguration. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Header aliasing in Traefik's reverse proxy middleware allows a low-privilege authenticated user to smuggle dot-form header aliases (e.g., X.Authenticated.User) past ForwardAuth and other security middleware, causing CGI, WSGI, PHP, or NGINX backends to read the attacker-supplied value instead of the identity Traefik asserted. In tested PHP 8.2 SAPI over HTTP/1, Go's lexical header ordering makes the attacker-supplied value win deterministically, enabling privilege escalation to any role or user identity the backend trusts via headers. This is an incomplete fix for GHSA-x677-9fxg-v5c5, which previously blocked only the underscore form; fixes exist in v2.11.56 and v3.7.12 but require explicit opt-in configuration to take effect. No public exploit or CISA KEV listing identified at time of analysis.
HTTP/3 read timeout enforcement is entirely absent in Traefik v2.8.2-v2.11.55 and v3.0.0-v3.7.11, enabling any unauthenticated remote client to hold connections open indefinitely by slowly trickling request body bytes over QUIC. Because QUIC streams cannot accept the TCP-level deadline used to enforce the default 60-second readTimeout, the HTTP/3 server was constructed with no timeout at all; each stalled request occupies one upstream connection. Repeated exploitation exhausts bounded backend connection pools and causes denial of service against proxied applications. Fixed in v2.11.56 and v3.7.12; no public exploit identified at time of analysis.
Authorization bypass in Traefik's IngressRouteTCP handler (versions 3.6.0-3.6.22 and 3.7.0-3.7.6) allows a low-privileged Kubernetes user to reference file-provider TCPServersTransport configurations across namespace boundaries that the crossProviderNamespaces allowlist should block. The allowlist was enforced for HTTP serversTransport references but silently omitted from the equivalent TCP code path, creating an inconsistent and exploitable access boundary. By crafting an IngressRouteTCP resource with serversTransport: foo@file, an attacker causes Traefik to apply privileged backend settings - including mTLS client certificates, SPIFFE workload identities, or PROXY-protocol configuration - belonging to namespaces they are not authorized to access. No public exploit code or CISA KEV listing exists at time of analysis; vendor-released patches are available in 3.6.23 and 3.7.7.
Namespace confusion in Traefik's Kubernetes Gateway API provider (versions 3.7.0-3.7.6) enables a low-privileged route author to attach unauthorized Traefik Middleware objects from foreign namespaces by exploiting incorrect namespace resolution in HTTPRoute extensionRef handling. An attacker holding an existing ReferenceGrant for a cross-namespace Service can leverage the flaw to inject trusted reverse-proxy identity headers into downstream requests - without a separate ReferenceGrant authorizing the Middleware - potentially bypassing authorization controls in backend services that trust those headers. No public exploit or CISA KEV listing has been identified at time of analysis; vendor-released fix is version 3.7.7.
Filter context poisoning in Traefik v3.7.0-v3.7.5 allows a low-privileged Kubernetes user to cause security-sensitive backendRef filters - such as tenant identity or authorization headers trusted by the backend - to be applied to requests from a different, co-located HTTPRoute that targets the same backend Service:port. This affects multi-tenant Kubernetes Gateway API deployments and can cross namespace boundaries when a ReferenceGrant permits cross-namespace backend targeting, making it an authorization bypass and tenant-isolation failure. No public exploit identified at time of analysis; the issue is fixed in Traefik v3.7.6.
Header injection in Traefik's ForwardAuth middleware allows unauthenticated remote attackers to manipulate the X-Forwarded-Port value sent to authentication backends, enabling bypass of port-based authorization checks. Affected are all Traefik v2.x prior to v2.11.51, v3.6.x from 3.0.0 prior to v3.6.22, and v3.7.x from 3.7.0 prior to v3.7.6. The flaw persists even when the trustForwardHeader: false safeguard is active, because the port derivation logic reads the original incoming request rather than the sanitized forwarded context. No public exploit code has been identified at time of analysis, and vendor-released patches are available.
Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 /. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Traefik reverse proxy and load balancer versions prior to 2.11.42, 3.6.11, and 3.7.0-ea.3 allow authenticated attackers to inject canonical HTTP header names that override non-canonical headers configured via the `headerField` setting, enabling identity impersonation to backend systems. The vulnerability exploits HTTP header handling inconsistencies where backends read the attacker-supplied canonical header before Traefik's non-canonical configuration, permitting authentication bypass for any identity. Vendor-released patches are available for all affected major versions.
Traefik's Knative provider fails to escape user-controlled values when interpolating host and header rules into backtick-delimited expressions, allowing attackers to inject rule syntax and bypass host restrictions in multi-tenant clusters. Versions prior to 3.6.11 and 3.7.0-ea.2 are affected. An attacker can craft malicious Knative ingress configurations to route traffic intended for one tenant to attacker-controlled hosts, enabling unauthorized cross-tenant traffic exposure and service impersonation.
Traefik's BasicAuth middleware contains a timing attack vulnerability that enables username enumeration through observable response time differences between valid and invalid usernames. An unauthenticated network attacker can distinguish existing usernames from non-existent ones by measuring response latency-valid usernames trigger ~166ms bcrypt operations while invalid usernames return in ~0.6ms, creating a ~298x timing differential. Affected versions include Traefik 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1; patches are available in versions 2.11.41, 3.6.11, and 3.7.0-ea.2.
Traefik versions prior to 2.11.38 and 3.6.9 fail to limit memory allocation when processing ForwardAuth middleware responses, allowing a malicious or compromised authentication server to trigger unbounded memory consumption. An attacker controlling the auth server can return an arbitrarily large response body that causes the Traefik process to exhaust available memory and crash, resulting in denial of service for all proxied routes. A patch is available in the specified versions.
Denial of service in Traefik versions prior to 2.11.35 and 3.6.7 allows unauthenticated remote attackers to exhaust server resources by establishing incomplete ACME TLS-ALPN connections and leaving them open indefinitely. An attacker can send minimal ClientHello messages with the acme-tls/1 protocol and cease responding, causing goroutines and file descriptors to be held until the entry point becomes unavailable. The vulnerability affects systems with ACME TLS challenge enabled.
Traefik is an HTTP reverse proxy and load balancer. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. Rated low severity (CVSS 2.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
Traefik is an HTTP reverse proxy and load balancer. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Traefik is an HTTP reverse proxy and load balancer. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Traefik is an open source HTTP reverse proxy and load balancer. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Traefik is an open source HTTP reverse proxy and load balancer. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Traefik is an open source HTTP reverse proxy and load balancer. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer for deploying microservices. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Traefik is an open source HTTP reverse proxy and load balancer. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Traefik is an open source HTTP reverse proxy and load balancer. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer that assists in deploying microservices. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Traefik is an HTTP reverse proxy and load balancer. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Traefik is an HTTP reverse proxy and load balancer. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.
Traefik before 2.4.5 allows the loading of IFRAME elements from other domains. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, there exists a potential open redirect vulnerability in Traefik's handling of the "X-Forwarded-Prefix" header. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required.
configurationwatcher.go in Traefik 2.x before 2.1.4 and TraefikEE 2.0.0 mishandles the purging of certificate contents from providers before logging. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without sufficient access control (which is contrary to the API. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
HTTP/1 request-target parsing in Traefik prior to 2.11.57 and 3.7.13 allows unauthenticated remote attackers to send a rootless URL target (e.g., `http:example.com/admin`) that Go's HTTP library stores in URL.Opaque rather than URL.Path, leaving URL.Path empty. Traefik's routing engine, forwardAuth middleware, and access logger all evaluate against the normalized empty path (treated as `/`), while URL.RequestURI() gives URL.Opaque precedence when forwarding — meaning the backend receives the original opaque target verbatim. The practical consequence is cross-vhost routing bypass, path-scoped authorization bypass, and access-log evasion, all requiring no authentication or special client configuration. No public exploit has been identified at time of analysis, though the patch PR includes test cases demonstrating the attack technique in full detail.
Security middleware bypass in Traefik reverse proxy versions 2.11.26-2.11.56 and 3.4.2-3.7.12 allows unauthenticated network attackers to reach protected backend routes by exploiting h2c protocol upgrade tunneling. When a crafted HTTP/1.1 request carrying Connection, Upgrade: h2c, and HTTP2-Settings headers causes a h2c-capable backend to respond with 101 Switching Protocols, Traefik enters a raw TCP tunnel that silently disables every configured middleware layer-including BasicAuth, ForwardAuth, IPAllowList, RateLimit, and all access logging, metrics, and tracing hooks-for the lifetime of that connection. All subsequent HTTP/2 frames in the tunnel reach protected backend paths without any Traefik security enforcement. No public exploit code has been identified at time of analysis; vendor-released fixes are available in v2.11.57 and v3.7.13.
Backend connection hijacking in Traefik reverse proxy (2.11.0 through 2.11.56 and 3.0.0 through 3.7.12) lets an unauthenticated remote client impersonate another user over HTTP/3. Because the HTTP/3 entrypoint never calls service.AddTransportOnContext, the kerberosRoundTripper falls back to a shared backend transport instead of one bound to each frontend connection, so when a backend uses connection-bound NTLM or Negotiate authentication with keep-alive, an unrelated client can reuse a backend connection already authenticated for a victim, read the victim's data, and act as the victim without ever obtaining their credentials. No public exploit is identified at time of analysis, though the fix PR ships a regression test that effectively demonstrates the flaw.
Traefik's header-security defenses (aliasHeadersStrategy, underscoreHeadersStrategy, forwardedHeaders) inspect req.Header but not req.Trailer, allowing unauthenticated clients on versions 3.2.0 through 3.7.12 to smuggle security-sensitive header values through HTTP/1.1 chunked trailers or HTTP/2 trailers. When retry or buffering middleware is active in the routing chain, attacker-controlled trailer values become accessible before the request is cloned for the backend; backends that merge trailers into their header namespace then receive the spoofed values, bypassing Traefik's documented delete or reject behavior. No public exploit code has been identified and this CVE is not in CISA KEV, but the impact on identity and routing integrity at the backend is classified high by the CVSS 4.0 subsequent-system metrics.
Authentication bypass in Traefik v3.7.0 through v3.7.11 lets remote unauthenticated attackers reach protected Kubernetes backends when an Ingress uses the ingress-nginx compatibility provider with both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. The provider generates a host-only 'sibling' router carrying only a non-terminal RedirectRegex middleware that still routes to the protected backend, so a crafted request evades the redirect and is proxied without any annotation-derived middleware. Reported by VulnCheck with a published advisory; no public exploit is identified at time of analysis, though the technique is fully documented and trivially reproducible.
Client-certificate authentication (mTLS) in Traefik before v2.11.55 can be silently bypassed by unauthenticated network attackers when routers are configured with multiple hostnames bearing conflicting TLS options. Traefik's conflict resolution logic incorrectly falls back to default (non-mTLS) TLS settings for all hostnames in the affected multi-host router, allowing an attacker to reach mTLS-protected backends without presenting a valid client certificate. No public exploit code or CISA KEV listing has been identified; the CVSS 4.0 AT:P metric confirms that exploitation depends on a specific deployment configuration being present.
Client certificate authentication bypass in Traefik v3.7.0-v3.7.10 allows unauthenticated network clients to reach services protected by the nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" annotation without presenting a valid mTLS client certificate. The flaw stems from a naming collision in the Kubernetes Ingress NGINX provider: when two Ingress objects share the same host, client CA secret, and authentication mode, Traefik's conflict-resolution logic silently falls back to the entry point's default TLS configuration, which imposes no client certificate requirement. No public exploit has been identified at time of analysis, and the issue is fixed in Traefik v3.7.11.
Authentication bypass in Traefik reverse proxy before v2.11.55 lets remote unauthenticated attackers defeat any route protected by the digestAuth middleware. The flaw stems from the middleware returning an empty secret for unknown usernames rather than rejecting them, so an attacker can craft a mathematically valid digest response from that empty secret and arbitrary credentials. Reported by VulnCheck with a fix in v2.11.55; no public exploit identified at time of analysis, though the trivial nature of the bypass makes weaponization straightforward.
Traefik's Kubernetes Ingress provider, starting from v3.7.1, incorrectly fails to enforce crossProviderNamespaces namespace-isolation controls on the traefik.ingress.kubernetes.io/service.middlewares Service annotation. A low-privileged tenant scoped to their own Kubernetes namespace can attach an operator-owned middleware from a namespace they are not permitted to reference, and if that middleware injects authentication credentials into backend requests, the attacker can exfiltrate those credentials via a backend endpoint under their control. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Route-level authentication bypass in Traefik v3.7.0-v3.7.7 allows unauthenticated remote attackers to reach backend endpoints protected by BasicAuth, DigestAuth, or ForwardAuth by exploiting unnormalized dot-segment paths generated by the Kubernetes Ingress NGINX provider's RewriteTarget middleware. When an Ingress path regex captures attacker-controlled text without requiring a path separator (e.g., /api(.*) rewriting to /$1), a crafted request such as /api../admin is rewritten to /../admin and forwarded to a backend that resolves it to /admin - a path secured on a separate Traefik router - entirely bypassing route-level access controls. No public exploit has been identified at time of analysis; a vendor patch is available in v3.7.8.
Authentication bypass in the Traefik reverse proxy (v2.11.51 and earlier, v3.6.0-v3.6.22, and v3.7.0-v3.7.6) allows unauthenticated remote attackers to reach protected backend routes by abusing the ReplacePathRegex middleware. When the middleware rewrites a path using a capture group lacking a mandatory separator, a crafted request such as GET /api../admin yields an un-normalized path (/../admin) that the middleware forwards without re-validation; a normalizing backend then resolves it to a protected route, skipping any auth middleware bound to that path. No public exploit identified at time of analysis, and no EPSS/KEV data was supplied, but the flaw is trivially reproducible from the advisory's own example.
Identity/authorization header spoofing in Traefik reverse proxy (before v2.11.51, v3.6.22, and v3.7.6) lets an attacker reaching a protected route smuggle an underscore-variant HTTP header past the BasicAuth, DigestAuth, and ForwardAuth middlewares' sanitization. Traefik strips canonical dashed spoofed headers before setting its own trusted value but ignores underscore forms (e.g. X_Forwarded_User vs X-Forwarded-User) that many backends normalize identically, so the forged header reaches the backend alongside — or, on the ForwardAuth authResponseHeaders path, instead of — Traefik's intended value. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but a vendor fix and upstream commit are published.
Traefik reverse proxy and load balancer contains an mTLS authentication bypass vulnerability that allows attackers to circumvent mutual TLS certificate requirements by sending fragmented TLS ClientHello packets. Affected versions include Traefik 2.11.40 and below, 3.0.0-beta1 through 3.6.10, and 3.7.0-ea.1. When ClientHello messages are fragmented across multiple TLS records, SNI extraction fails with an EOF error, causing the TCP router to fall back to default TLS configuration without client certificate validation, enabling unauthorized access to services that should require mTLS authentication.
Traefik versions 2.11.9-2.11.37 and 3.1.3-3.6.8 contain a case-sensitivity bypass in Connection header handling that allows unauthenticated remote attackers to remove critical X-Forwarded headers by using lowercase Connection tokens, potentially enabling header spoofing attacks. An attacker can exploit this to manipulate forwarded client information such as IP addresses and hostnames, compromising the integrity of upstream application data. A patch is available for affected versions.
Traefik versions before 2.11.38 and 3.6.9 allow remote attackers to cause denial of service by sending incomplete TLS records to TCP routers, which causes the TLS handshake process to hang indefinitely while holding connections open. An unauthenticated attacker can exploit this by opening many stalled connections in parallel to exhaust file descriptors and goroutines, degrading or disabling the proxy service.
Denial of service in Traefik versions prior to 3.6.8 allows unauthenticated remote attackers to exhaust connection resources by exploiting improper timeout handling in STARTTLS request processing. An attacker can send a PostgreSQL SSLRequest prelude and then stall the connection indefinitely, bypassing the readTimeout protection and accumulating open connections until service availability is degraded. A patch is available in version 3.6.8.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
HTTP/3 read timeout non-enforcement in Traefik allows unauthenticated remote attackers to exhaust upstream backend connection pools by trickling request body data indefinitely over QUIC streams. Versions 2.8.2 through 2.11.55 and 3.x through 3.7.11 fail to apply the configured `readTimeout` to HTTP/3 entrypoints because that timeout is enforced at the TCP connection layer and QUIC streams have no corresponding deadline. Attackers with access to an exposed HTTP/3 endpoint can hold upstream connections open without triggering any server-side timeout, progressively exhausting backends with bounded connection pools. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.
ForwardAuth identity spoofing in Traefik allows authenticated network users to impersonate arbitrary identities on normalization-prone backends by sending dot-form HTTP headers (e.g., X.Authenticated.User) that Go's net/http layer treats as distinct from their dash-form equivalents (X-Authenticated-User), while CGI, WSGI, PHP, and NGINX backends collapse both into the same environment variable. Affected deployments span the 2.x branch below v2.11.56 and the 3.x branch from 3.0.0 through 3.7.12; the protective aliasHeadersStrategy option defaults to keep, meaning all unpatched deployments with ForwardAuth and normalization-prone backends are exposed without any additional misconfiguration. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Header aliasing in Traefik's reverse proxy middleware allows a low-privilege authenticated user to smuggle dot-form header aliases (e.g., X.Authenticated.User) past ForwardAuth and other security middleware, causing CGI, WSGI, PHP, or NGINX backends to read the attacker-supplied value instead of the identity Traefik asserted. In tested PHP 8.2 SAPI over HTTP/1, Go's lexical header ordering makes the attacker-supplied value win deterministically, enabling privilege escalation to any role or user identity the backend trusts via headers. This is an incomplete fix for GHSA-x677-9fxg-v5c5, which previously blocked only the underscore form; fixes exist in v2.11.56 and v3.7.12 but require explicit opt-in configuration to take effect. No public exploit or CISA KEV listing identified at time of analysis.
HTTP/3 read timeout enforcement is entirely absent in Traefik v2.8.2-v2.11.55 and v3.0.0-v3.7.11, enabling any unauthenticated remote client to hold connections open indefinitely by slowly trickling request body bytes over QUIC. Because QUIC streams cannot accept the TCP-level deadline used to enforce the default 60-second readTimeout, the HTTP/3 server was constructed with no timeout at all; each stalled request occupies one upstream connection. Repeated exploitation exhausts bounded backend connection pools and causes denial of service against proxied applications. Fixed in v2.11.56 and v3.7.12; no public exploit identified at time of analysis.
Authorization bypass in Traefik's IngressRouteTCP handler (versions 3.6.0-3.6.22 and 3.7.0-3.7.6) allows a low-privileged Kubernetes user to reference file-provider TCPServersTransport configurations across namespace boundaries that the crossProviderNamespaces allowlist should block. The allowlist was enforced for HTTP serversTransport references but silently omitted from the equivalent TCP code path, creating an inconsistent and exploitable access boundary. By crafting an IngressRouteTCP resource with serversTransport: foo@file, an attacker causes Traefik to apply privileged backend settings - including mTLS client certificates, SPIFFE workload identities, or PROXY-protocol configuration - belonging to namespaces they are not authorized to access. No public exploit code or CISA KEV listing exists at time of analysis; vendor-released patches are available in 3.6.23 and 3.7.7.
Namespace confusion in Traefik's Kubernetes Gateway API provider (versions 3.7.0-3.7.6) enables a low-privileged route author to attach unauthorized Traefik Middleware objects from foreign namespaces by exploiting incorrect namespace resolution in HTTPRoute extensionRef handling. An attacker holding an existing ReferenceGrant for a cross-namespace Service can leverage the flaw to inject trusted reverse-proxy identity headers into downstream requests - without a separate ReferenceGrant authorizing the Middleware - potentially bypassing authorization controls in backend services that trust those headers. No public exploit or CISA KEV listing has been identified at time of analysis; vendor-released fix is version 3.7.7.
Filter context poisoning in Traefik v3.7.0-v3.7.5 allows a low-privileged Kubernetes user to cause security-sensitive backendRef filters - such as tenant identity or authorization headers trusted by the backend - to be applied to requests from a different, co-located HTTPRoute that targets the same backend Service:port. This affects multi-tenant Kubernetes Gateway API deployments and can cross namespace boundaries when a ReferenceGrant permits cross-namespace backend targeting, making it an authorization bypass and tenant-isolation failure. No public exploit identified at time of analysis; the issue is fixed in Traefik v3.7.6.
Header injection in Traefik's ForwardAuth middleware allows unauthenticated remote attackers to manipulate the X-Forwarded-Port value sent to authentication backends, enabling bypass of port-based authorization checks. Affected are all Traefik v2.x prior to v2.11.51, v3.6.x from 3.0.0 prior to v3.6.22, and v3.7.x from 3.7.0 prior to v3.7.6. The flaw persists even when the trustForwardHeader: false safeguard is active, because the port derivation logic reads the original incoming request rather than the sanitized forwarded context. No public exploit code has been identified at time of analysis, and vendor-released patches are available.
Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 /. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Traefik reverse proxy and load balancer versions prior to 2.11.42, 3.6.11, and 3.7.0-ea.3 allow authenticated attackers to inject canonical HTTP header names that override non-canonical headers configured via the `headerField` setting, enabling identity impersonation to backend systems. The vulnerability exploits HTTP header handling inconsistencies where backends read the attacker-supplied canonical header before Traefik's non-canonical configuration, permitting authentication bypass for any identity. Vendor-released patches are available for all affected major versions.
Traefik's Knative provider fails to escape user-controlled values when interpolating host and header rules into backtick-delimited expressions, allowing attackers to inject rule syntax and bypass host restrictions in multi-tenant clusters. Versions prior to 3.6.11 and 3.7.0-ea.2 are affected. An attacker can craft malicious Knative ingress configurations to route traffic intended for one tenant to attacker-controlled hosts, enabling unauthorized cross-tenant traffic exposure and service impersonation.
Traefik's BasicAuth middleware contains a timing attack vulnerability that enables username enumeration through observable response time differences between valid and invalid usernames. An unauthenticated network attacker can distinguish existing usernames from non-existent ones by measuring response latency-valid usernames trigger ~166ms bcrypt operations while invalid usernames return in ~0.6ms, creating a ~298x timing differential. Affected versions include Traefik 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1; patches are available in versions 2.11.41, 3.6.11, and 3.7.0-ea.2.
Traefik versions prior to 2.11.38 and 3.6.9 fail to limit memory allocation when processing ForwardAuth middleware responses, allowing a malicious or compromised authentication server to trigger unbounded memory consumption. An attacker controlling the auth server can return an arbitrarily large response body that causes the Traefik process to exhaust available memory and crash, resulting in denial of service for all proxied routes. A patch is available in the specified versions.
Denial of service in Traefik versions prior to 2.11.35 and 3.6.7 allows unauthenticated remote attackers to exhaust server resources by establishing incomplete ACME TLS-ALPN connections and leaving them open indefinitely. An attacker can send minimal ClientHello messages with the acme-tls/1 protocol and cease responding, causing goroutines and file descriptors to be held until the entry point becomes unavailable. The vulnerability affects systems with ACME TLS challenge enabled.
Traefik is an HTTP reverse proxy and load balancer. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. Rated low severity (CVSS 2.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
Traefik is an HTTP reverse proxy and load balancer. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Traefik is an HTTP reverse proxy and load balancer. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Traefik is an open source HTTP reverse proxy and load balancer. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Traefik is an open source HTTP reverse proxy and load balancer. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Traefik is an open source HTTP reverse proxy and load balancer. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer for deploying microservices. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Traefik is an open source HTTP reverse proxy and load balancer. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Traefik is an open source HTTP reverse proxy and load balancer. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer that assists in deploying microservices. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Traefik is an HTTP reverse proxy and load balancer. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Traefik is an HTTP reverse proxy and load balancer. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.
Traefik before 2.4.5 allows the loading of IFRAME elements from other domains. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, there exists a potential open redirect vulnerability in Traefik's handling of the "X-Forwarded-Prefix" header. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required.
configurationwatcher.go in Traefik 2.x before 2.1.4 and TraefikEE 2.0.0 mishandles the purging of certificate contents from providers before logging. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without sufficient access control (which is contrary to the API. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.