[ Vendor · 11 CVEs ]
traefik
CVEs affecting traefik published in the last 30 days, plus any traefik CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114641 | 22 Oct 2026 | CVSS 3.7 | traefikTraefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the… | |
| CVE-2026-114642 | 22 Oct 2026 | CVSS 8.7 | traefikTraefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by… | |
| CVE-2026-114656 | 22 Oct 2026 | CVSS 7.5 | traefikTraefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate… | |
| CVE-2026-114635 | 22 Oct 2026 | CVSS 8.7 | traefikTraefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil… | |
| CVE-2026-114636 | 22 Oct 2026 | CVSS 8.7 | traefikTraefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for… | |
| CVE-2026-114637 | 22 Oct 2026 | CVSS 8.7 | traefikTraefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin… | |
| CVE-2026-114638 | 22 Oct 2026 | CVSS 8.7 | traefikTraefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when… | |
| CVE-2026-114639 | 22 Oct 2026 | CVSS 8.7 | traefikTraefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an… | |
| CVE-2026-114640 | 22 Oct 2026 | CVSS 8.7 | traefikTraefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards… | |
| CVE-2026-112778 | 19 Oct 2026 | CVSS 6.4 | traefikTraefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress… | |
| CVE-2026-88010 | 22 Sep 2026 | CVSS 6.3 | Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracleTraefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basic_auth.go… | Fix |