traefik

9 records · 9 with a public proof-of-concept

Disclosed vulnerabilities where the NVD names traefik as an affected vendor, highest CVSS first.

  1. HIGH 8.8CVE-2026-112778public PoC2026-10-19

    Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to …

    traefik

    AI risk analysis on Exploit-DB.ai →

  2. HIGH 8.7CVE-2026-114642public PoC2026-10-22

    Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticate…

    traefik

    AI risk analysis on Exploit-DB.ai →

  3. HIGH 8.7CVE-2026-114640public PoC2026-10-22

    Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on the plaintext HTTP router. When ssl-redirect is disabled alongside auth-tls-pass-c…

    traefik

    AI risk analysis on Exploit-DB.ai →

  4. HIGH 8.7CVE-2026-114639public PoC2026-10-22

    Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolat…

    traefik

    AI risk analysis on Exploit-DB.ai →

  5. HIGH 8.7CVE-2026-114638public PoC2026-10-22

    Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide after dot-to-dash normalization. Attackers holding certificates from another host…

    traefik

    AI risk analysis on Exploit-DB.ai →

  6. HIGH 8.7CVE-2026-114637public PoC2026-10-22

    Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be h…

    traefik

    AI risk analysis on Exploit-DB.ai →

  7. HIGH 8.7CVE-2026-114636public PoC2026-10-22

    Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations. Unauthentic…

    traefik

    AI risk analysis on Exploit-DB.ai →

  8. HIGH 8.7CVE-2026-114635public PoC2026-10-22

    Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 build…

    traefik

    AI risk analysis on Exploit-DB.ai →

  9. LOW 3.7CVE-2026-114641public PoC2026-10-22

    Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote attackers can send con…

    traefik

    AI risk analysis on Exploit-DB.ai →