Skip to contentTraefik vulnerabilities
Newest
- traefik, red hat openshift dev spaces 3.28 +1 moreTraefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass authCVE-2026-35051Fix available7.8 High
- traefik, red hat openshift dev spaces 3.27 +1 moreTraefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerFieldCVE-2026-33433Fix available5.1 Medium
- traefik, red hat openshift dev spaces 3.27 +1 moreTraefik has Knative Ingress Rule Injection that Allows Host Restriction BypassCVE-2026-32695Fix available6.3 Medium
- traefikTraefik: BasicAuth Middleware Timing Attack Allows Username EnumerationCVE-2026-32595Fix available6.3 Medium
- traefik, red hat openshift dev spaces 3.27, openshift dev spaces 3.28 +1 more +3 moreTraefik mTLS bypass via fragmented ClientHello SNI extraction failureCVE-2026-32305Fix available7.8 High
- traefikTraefik has a kubernetes gateway rule injection via unescaped backticks in HTTPRoute match valuesCVE-2026-29777Fix available6.1 Medium
- traefik, red hat openshift dev spaces 3.27 +1 moreTraefik: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`)CVE-2026-29054Fix available7.5 High
- traefik, red hat openshift dev spaces 3.27 +1 moreTraefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (slowloris doS)CVE-2026-26999Fix available7.5 High
- traefikTraefik: unbounded io.ReadAll on auth server response body causes OOM denial of service(DOS)CVE-2026-26998Fix available4.4 Medium
- traefik, red hat openshift dev spaces 3.27 +1 moreTraefik: TCP readTimeout bypass via STARTTLS on PostgresCVE-2026-25949Fix available7.5 High
- traefikTraefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stallCVE-2026-22045Fix available5.9 Medium
- traefikTraefik has Inverted TLS Verification Logic in its ingress-nginx ProviderCVE-2025-66491Fix available5.9 Medium
- traefikTraefik doesn't Prevent Path Normalization Bypass in Router + Middleware RulesCVE-2025-66490Fix available6.9 Medium
- traefikTraefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code ExecutionCVE-2025-54386Fix available7.3 High
- traefikTraefik allows path traversal using url encodingCVE-2025-47952Fix available2.9 Low
- traefikTraefik has a possible vulnerability with the path matchersCVE-2025-32431Fix available8.8 High
- traefikX-Forwarded-Prefix Header still allows for Open Redirect in traefikCVE-2024-52003Fix available6.3 Medium
- traefikHTTP client can remove the X-Forwarded headers in TraefikCVE-2024-45410Public exploitFix available9.8 Critical
- traefikTraefik vulnerable to bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakesCVE-2024-39321Fix available7.5 High
- traefikPossible denial of service vulnerability with Content-length header in TraefikCVE-2024-28869Fix available7.5 High
- traefikUncontrolled Resource Consumption in TraefikCVE-2023-47633Fix available7.5 High
- traefikIncorrect processing of fragment in the URL leads to Authorization Bypass in TraefikCVE-2023-47106Fix available4.8 Medium
- traefikDenial of service whith ACME HTTPChallenge in TraefikCVE-2023-47124Fix available5.9 Medium
- golang go, traefik, red hat openshift ai (rhoai) +2 more +4 moreTraefik - Denial of Service via HTTP/2 Request HandlingCVE-2023-54365Fix available8.7 High
- eclipse jetty, ietf http, http/2 +166 more +168 moreEclipse Jetty XmlParser allows arbitrary DOCTYPE declarationsCVE-2023-44487In KEVPublic exploitFix availableEPSS 100.0%7.5 High
- traefikHTTP header parsing could cause a deny of serviceCVE-2023-29013Fix available7.5 High
- traefikAuthorization header displayed in the debug logsCVE-2022-23469Fix available3.5 Low
- traefikRoutes exposed with an empty TLSOption in traefikCVE-2022-46153Fix available8.1 High
- traefikTraefik HTTP/2 connections management could cause a denial of serviceCVE-2022-39271Fix available7.5 High
- traefik, oracle communications unified inventory management +1 moreTraefik skips the router TLS configuration when the host header is an FQDNCVE-2022-23632Fix available7.4 High
- traefikDrop Headers via Malicious Connection HeaderCVE-2021-32813Fix available4.8 Medium
- containous traefikOpen redirect in TraefikCVE-2020-15129Fix available6.1 Medium
- traefikImproper AuthenticationCVE-2019-20894Fix available7.5 High
- traefik, traefik enterprise +1 moreTraefik has an Improper Certificate Handling issueCVE-2020-9321Fix available7.5 High
- traefikContainous Traefik Exposes Password HashesCVE-2019-12452Fix available7.5 High
- traefikTraefik Missing AuthenticationCVE-2018-15598Fix available7.5 High