InfraGuard
Anmelden Jetzt ausprobieren Jetzt kaufen

Traefik-Schwachstellen (CVE-Liste)

Traefik ist ein moderner Webserver und Edge-Router, der zur Verwaltung des eingehenden Netzwerkverkehrs für verteilte Dienste verwendet wird.

87 CVEs1 KEV9.8 max. CVSS

Was die Historie zeigt

Traefik weist 85 erfasste CVEs mit einem maximalen CVSS-Score von 9.3 auf, darunter 1 Eintrag im Katalog bekannter ausgenutzter Schwachstellen (KEV). Der neueste mit der Software verknüpfte CVE stammt vom 2026-10-30.

So bleiben Sie sicher

Betreiber sollten auf unterstützten Release-Linien wie 3.7 bleiben und ausgeführte Versionen kontinuierlich im Hinblick auf Sicherheitsupdates verfolgen.

Version prüfentraefik version

Betroffene Versionslinien

Bekannte Schwachstellen

CVE Titel Betroffene Versionen CVSS Ausgenutzt EPSS Veröffentlicht
CVE-2023-44487 The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can... < 2.10.5 = 3.0.0 7.5 KEV 100.0% 2023-10-10
CVE-2026-121966 Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak < 2.11.60 ≥ 3.0.0 < 3.7.16 7.0 — 2026-11-05
CVE-2026-119573 Traefik 3.7.11 before 3.7.15 Cross-Namespace Authorization Bypass via auth-tls-secret ≥ 3.7.11 < 3.7.15 2.1 — 2026-10-30
CVE-2026-119574 Traefik 3.2.0 before 3.7.15 FastProxy Data Race Denial of Service ≥ 3.2.0 < 3.7.15 8.2 — 2026-10-30
CVE-2026-119572 Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider ≥ 3.7.0-ea.1 < 3.7.15 7.0 — 2026-10-30
CVE-2026-114656 Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher < 2.11.58 ≥ 3.0.0 < 3.7.13 6.9 — 2026-10-22
CVE-2026-114642 Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper ≥ 2.11.0 < 2.11.58 ≥ 3.0.0 < 3.7.14 7.0 — 2026-10-22
CVE-2026-114641 Traefik before 2.11.58 and 3.7.14 Race Condition in NTLM/Kerberos Round Tripper ≥ 2.11.0 < 2.11.58 ≥ 3.0.0 < 3.7.14 6.3 — 2026-10-22
CVE-2026-114639 Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool ≥ 2.11.0 < 2.11.58 ≥ 3.0.0 < 3.7.14 7.0 — 2026-10-22
CVE-2026-114640 Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router ≥ 3.7.0 < 3.7.14 7.0 — 2026-10-22
CVE-2026-114638 Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision ≥ 3.7.0 < 3.7.14 7.0 — 2026-10-22
CVE-2026-114636 Traefik v3.7.13 Authentication Bypass via ssl-passthrough Ingress HTTP Router = 3.7.13 ≥ 3.7.13 < 3.7.14 7.0 — 2026-10-22
CVE-2026-114637 Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leak ≥ 3.2.0 < 3.7.14 7.0 — 2026-10-22
CVE-2026-114635 Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme < 2.11.58 ≥ 3.0.0 < 3.7.14 7.0 — 2026-10-22
CVE-2026-112778 Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations < 2.11.46 ≥ 3.0.0 < 3.6.16 = 3.7.0 6.4 — 2026-10-20
CVE-2026-88010 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle ≥ 3.6.11 < 3.7.13 * 6.3 — 2026-09-23
CVE-2026-88012 Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded ≥ 2.8.2 < 2.11.56 ≥ 3.0.0 < 3.7.12 * 5.3 — 2026-09-11
CVE-2026-88011 Traefik: ForwardAuth identity spoofing via dot-form header alias < 2.11.56 ≥ 3.0.0 < 3.7.12 * 5.3 — 2026-09-11
CVE-2026-88009 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing... < 2.11.57 ≥ 3.0.0 < 3.7.13 * 8.8 — 2026-09-11
CVE-2026-88008 Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Author... ≥ 2.11.26 < 2.11.57 ≥ 3.4.2 < 3.7.13 * 7.0 — 2026-09-10
CVE-2026-88007 Traefik HTTP/3 Backend NTLM Connection Reuse ≥ 2.8.2 < 2.11.56 ≥ 3.0.0 < 3.7.12 * 9.1 — 2026-09-10
CVE-2026-88004 Traefik entrypoint header-name sanitization bypassed via request trailers ≥ 3.2.0 < 3.7.13 * 7.0 — 2026-09-10
CVE-2026-88878 Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass ≥ 2.8.2 < 2.11.56 ≥ 3.0.0 < 3.7.12 * 6.9 — 2026-09-10
CVE-2026-88879 Traefik before v2.11.56 Identity Spoofing via Header Alias ≥ 1.0 < 2.11.56 ≥ 3.0.0 < 3.7.12 * 5.3 — 2026-09-10
CVE-2026-88877 Traefik v3.7.0 Authentication Bypass via from-to-www-redirect ≥ 3.7.0 < 3.7.12 ≥ 3.7.0 ≤ 3.7.13 9.3 — 2026-09-10
CVE-2026-85596 Traefik v3.7 Authentication Bypass via TLS Option Conflict ≥ 3.7.0 < 3.7.11 ≥ 3.7.0 ≤ 3.7.10 8.2 — 2026-09-04
CVE-2026-85597 Traefik before v2.11.55 and v3.0.0 through v3.7.10 mTLS Bypass via TLS Option Conflict < 2.11.55 ≥ 3.0.0 < 3.7.11 ≥ 3.0.0 ≤ 3.7.10 8.2 — 2026-09-04
CVE-2026-85595 Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth < 2.11.55 ≥ 3.0.0 < 3.7.11 ≥ 3.0.0 ≤ 3.7.10 9.3 — 2026-09-04
CVE-2026-85594 Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware < 3.7.11 ≥ 3.7.1 ≤ 3.7.12 7.0 — 2026-09-04
CVE-2026-71327 Traefik: Gateway API route identity collision allows cross-namespace backend hijacking ≥ 3.0.0 < 3.6.25 ≥ 3.7.0 < 3.7.10 * 7.6 — 2026-08-07
CVE-2026-71326 Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing ≥ 3.6.11 < 3.6.25 ≥ 3.7.0 < 3.7.10 * 2.1 — 2026-08-07
CVE-2026-71325 Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef < 2.11.54 ≥ 3.0.0 < 3.6.25 ≥ 3.7.0 ≤ 3.7.10 4.8 — 2026-08-07
CVE-2026-71324 Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool < 2.11.53 ≥ 3.0.0 < 3.6.24 ≥ 3.7.0 < 3.7.9 7.0 — 2026-08-07
CVE-2026-67309 Traefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypass ≥ 3.7.0 < 3.7.8 * 7.8 — 2026-08-01
CVE-2026-65602 Traefik before 3.6.23 IngressRouteTCP ServersTransport Namespace Bypass ≥ 3.6.0 < 3.6.23 ≥ 3.7.0 < 3.7.7 * 5.3 — 2026-07-22
CVE-2026-65601 Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef ≥ 3.7.0 < 3.7.7 * 5.3 — 2026-07-22
CVE-2026-65600 Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex < 2.11.52 ≥ 3.6.0 < 3.6.23 ≥ 3.7.0 < 3.7.7 7.8 — 2026-07-22
CVE-2026-54763 Traefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth < 2.11.51 ≥ 3.0.0 < 3.6.22 ≥ 3.7.0 < 3.7.6 7.8 — 2026-07-07
CVE-2026-54765 Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port ≥ 3.7.0 < 3.7.6 * 6.3 — 2026-07-07
CVE-2026-54764 ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader... < 2.11.51 ≥ 3.0.0 < 3.6.22 ≥ 3.7.0 < 3.7.6 6.9 — 2026-07-07
CVE-2026-54762 Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails ≥ 3.7.0 < 3.7.5 * 5.9 — 2026-06-24
CVE-2026-54761 Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose in... < 3.6.21 ≥ 3.7.0 < 3.7.5 ≤ 1.7.34 6.0 — 2026-06-24
CVE-2026-53622 Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts < 3.7.3 ≤ 1.7.34 * 7.8 — 2026-06-24
CVE-2026-48491 Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass ≥ 3.7.0 < 3.7.3 * 7.8 — 2026-06-24
CVE-2026-48020 Traefik StripPrefix Route-Level Auth Bypass via Path Normalization < 2.11.48 ≥ 3.0.0 < 3.6.19 ≥ 3.7.0 < 3.7.3 7.8 — 2026-06-24
CVE-2023-54365 Traefik - Denial of Service via HTTP/2 Request Handling < 2.10.5 = 3.0.0 ≥ 3.0.0-beta1 < 3.0.0-beta4 8.7 — 2026-06-23
CVE-2026-44774 Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST... < 2.11.46 ≥ 3.0.0 < 3.6.17 ≥ 3.7.0 < 3.7.1 6.4 — 2026-05-16
CVE-2026-41181 Traefik: Errors middleware forwards Authorization and Cookie headers to separate error page service < 2.11.44 ≥ 3.0.0 < 3.6.15 = 3.7.0 6.9 — 2026-05-16
CVE-2026-41263 Traefik: BasicAuth middleware: timing side-channel vulnerability < 2.11.43 ≥ 3.0.0 < 3.6.14 = 3.7.0 6.3 — 2026-05-01
CVE-2026-40912 Traefik: StripPrefixRegex auth bypass via Path/RawPath desync < 2.11.43 ≥ 3.0.0 < 3.6.14 = 3.7.0 7.8 — 2026-05-01
CVE-2026-39858 Traefik: Forwarded alias spoofing top pre-auth decision bypass < 2.11.43 ≥ 3.0.0 < 3.6.14 = 3.7.0 7.8 — 2026-05-01
CVE-2026-35051 Traefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth < 2.11.43 ≥ 3.0.0 < 3.6.14 = 3.7.0 7.8 — 2026-05-01
CVE-2026-41174 Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding < 2.11.43 ≥ 3.0.0 < 3.6.14 = 3.7.0 4.8 — 2026-05-01
CVE-2026-33433 Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField < 2.11.42 ≥ 3.0.0 < 3.6.12 = 3.7.0 5.1 — 2026-03-27
CVE-2026-32695 Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass < 3.6.11 = 3.7.0 * 6.3 — 2026-03-27
CVE-2026-32595 Traefik: BasicAuth Middleware Timing Attack Allows Username Enumeration < 2.11.41 ≥ 3.0.0 ≤ 3.6.11 = 3.7.0 6.3 — 2026-03-20
CVE-2026-32305 Traefik mTLS bypass via fragmented ClientHello SNI extraction failure < 2.11.41 ≥ 3.0.0 ≤ 3.6.11 = 3.7.0 7.8 — 2026-03-20
CVE-2026-29777 Traefik has a kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values < 3.6.10 ≤ 1.7.34 * 6.1 — 2026-03-12
CVE-2026-29054 Traefik: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-... ≥ 2.11.9 < 2.11.38 ≥ 3.1.3 < 3.6.9 * 7.5 — 2026-03-06
CVE-2026-26999 Traefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (slowloris doS) < 2.11.38 ≥ 3.0.0 < 3.6.9 * 7.5 — 2026-03-06
Offizielle Website Quellcode Eintrag auf SolutionMarket

Verfolgen Sie diese Versionen auf Ihren eigenen Servern

InfraGuard erfasst die installierten Softwareversionen auf jedem Server und markiert diejenigen mit bekannten Schwachstellen. Self-Hosted – nichts verlässt Ihr Netzwerk.

Live-Demo ausprobieren Jetzt kaufen

Wöchentlicher Digest ausgenutzter Schwachstellen

Die für Self-Hosted-Server relevanten KEV-Neuzugänge, einmal pro Woche. Keine weiteren E-Mails.

Daten: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (siehe EPSS unter https://www.first.org/epss), endoflife.date. Softwareliste: awesome-selfhosted (CC BY-SA 3.0).