Ce que montre l’historique
Traefik compte 85 CVE enregistrés avec un score CVSS maximal de 9.3, dont 1 entrée dans le catalogue des vulnérabilités connues pour être exploitées (KEV). Le dernier CVE associé au logiciel est daté du 2026-10-30.
Comment rester protégé
Les opérateurs doivent rester sur des lignes de version prises en charge telles que 3.7 et suivre en continu les versions en cours d'exécution par rapport aux mises à jour de sécurité.
Vérifiez votre version
traefik versionBranches de versions concernées
- 3.7 55 CVE
- 3.6 51 CVE Fin de vie
- 3.5 48 CVE Fin de vie
- 3.4 49 CVE Fin de vie
- 3.3 48 CVE Fin de vie
- 3.2 49 CVE Fin de vie
- 3.1 48 CVE Fin de vie
- 3.0 53 CVE KEV 1 Fin de vie
- 2.11 50 CVE Fin de vie
- 2.10 51 CVE KEV 1 Fin de vie
- 2.9 54 CVE KEV 1 Fin de vie
- 2.8 54 CVE KEV 1 Fin de vie
- 2.6 52 CVE KEV 1 Fin de vie
- 2.4 54 CVE KEV 1 Fin de vie
- 2.3 55 CVE KEV 1 Fin de vie
- 2.2 55 CVE KEV 1 Fin de vie
- 2.1 55 CVE KEV 1 Fin de vie
- 2.0 56 CVE KEV 1 Fin de vie
- 1.7 57 CVE KEV 1 Fin de vie
- 1.6 57 CVE KEV 1
- 1.5 56 CVE KEV 1
- 1.0 56 CVE KEV 1
Vulnérabilités connues
| CVE | Titre | Versions concernées | CVSS | Exploitée | EPSS | Publication |
|---|---|---|---|---|---|---|
| CVE-2023-44487 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can... | < 2.10.5 = 3.0.0 | 7.5 | KEV | 100.0% | 2023-10-10 |
| CVE-2026-121966 | Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak | < 2.11.60 ≥ 3.0.0 < 3.7.16 | 7.0 | — | 2026-11-05 | |
| CVE-2026-119573 | Traefik 3.7.11 before 3.7.15 Cross-Namespace Authorization Bypass via auth-tls-secret | ≥ 3.7.11 < 3.7.15 | 2.1 | — | 2026-10-30 | |
| CVE-2026-119574 | Traefik 3.2.0 before 3.7.15 FastProxy Data Race Denial of Service | ≥ 3.2.0 < 3.7.15 | 8.2 | — | 2026-10-30 | |
| CVE-2026-119572 | Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider | ≥ 3.7.0-ea.1 < 3.7.15 | 7.0 | — | 2026-10-30 | |
| CVE-2026-114656 | Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher | < 2.11.58 ≥ 3.0.0 < 3.7.13 | 6.9 | — | 2026-10-22 | |
| CVE-2026-114642 | Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper | ≥ 2.11.0 < 2.11.58 ≥ 3.0.0 < 3.7.14 | 7.0 | — | 2026-10-22 | |
| CVE-2026-114641 | Traefik before 2.11.58 and 3.7.14 Race Condition in NTLM/Kerberos Round Tripper | ≥ 2.11.0 < 2.11.58 ≥ 3.0.0 < 3.7.14 | 6.3 | — | 2026-10-22 | |
| CVE-2026-114639 | Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool | ≥ 2.11.0 < 2.11.58 ≥ 3.0.0 < 3.7.14 | 7.0 | — | 2026-10-22 | |
| CVE-2026-114640 | Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router | ≥ 3.7.0 < 3.7.14 | 7.0 | — | 2026-10-22 | |
| CVE-2026-114638 | Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision | ≥ 3.7.0 < 3.7.14 | 7.0 | — | 2026-10-22 | |
| CVE-2026-114636 | Traefik v3.7.13 Authentication Bypass via ssl-passthrough Ingress HTTP Router | = 3.7.13 ≥ 3.7.13 < 3.7.14 | 7.0 | — | 2026-10-22 | |
| CVE-2026-114637 | Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leak | ≥ 3.2.0 < 3.7.14 | 7.0 | — | 2026-10-22 | |
| CVE-2026-114635 | Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme | < 2.11.58 ≥ 3.0.0 < 3.7.14 | 7.0 | — | 2026-10-22 | |
| CVE-2026-112778 | Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations | < 2.11.46 ≥ 3.0.0 < 3.6.16 = 3.7.0 | 6.4 | — | 2026-10-20 | |
| CVE-2026-88010 | Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle | ≥ 3.6.11 < 3.7.13 * | 6.3 | — | 2026-09-23 | |
| CVE-2026-88012 | Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded | ≥ 2.8.2 < 2.11.56 ≥ 3.0.0 < 3.7.12 * | 5.3 | — | 2026-09-11 | |
| CVE-2026-88011 | Traefik: ForwardAuth identity spoofing via dot-form header alias | < 2.11.56 ≥ 3.0.0 < 3.7.12 * | 5.3 | — | 2026-09-11 | |
| CVE-2026-88009 | Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing... | < 2.11.57 ≥ 3.0.0 < 3.7.13 * | 8.8 | — | 2026-09-11 | |
| CVE-2026-88008 | Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Author... | ≥ 2.11.26 < 2.11.57 ≥ 3.4.2 < 3.7.13 * | 7.0 | — | 2026-09-10 | |
| CVE-2026-88007 | Traefik HTTP/3 Backend NTLM Connection Reuse | ≥ 2.8.2 < 2.11.56 ≥ 3.0.0 < 3.7.12 * | 9.1 | — | 2026-09-10 | |
| CVE-2026-88004 | Traefik entrypoint header-name sanitization bypassed via request trailers | ≥ 3.2.0 < 3.7.13 * | 7.0 | — | 2026-09-10 | |
| CVE-2026-88878 | Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass | ≥ 2.8.2 < 2.11.56 ≥ 3.0.0 < 3.7.12 * | 6.9 | — | 2026-09-10 | |
| CVE-2026-88879 | Traefik before v2.11.56 Identity Spoofing via Header Alias | ≥ 1.0 < 2.11.56 ≥ 3.0.0 < 3.7.12 * | 5.3 | — | 2026-09-10 | |
| CVE-2026-88877 | Traefik v3.7.0 Authentication Bypass via from-to-www-redirect | ≥ 3.7.0 < 3.7.12 ≥ 3.7.0 ≤ 3.7.13 | 9.3 | — | 2026-09-10 | |
| CVE-2026-85596 | Traefik v3.7 Authentication Bypass via TLS Option Conflict | ≥ 3.7.0 < 3.7.11 ≥ 3.7.0 ≤ 3.7.10 | 8.2 | — | 2026-09-04 | |
| CVE-2026-85597 | Traefik before v2.11.55 and v3.0.0 through v3.7.10 mTLS Bypass via TLS Option Conflict | < 2.11.55 ≥ 3.0.0 < 3.7.11 ≥ 3.0.0 ≤ 3.7.10 | 8.2 | — | 2026-09-04 | |
| CVE-2026-85595 | Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth | < 2.11.55 ≥ 3.0.0 < 3.7.11 ≥ 3.0.0 ≤ 3.7.10 | 9.3 | — | 2026-09-04 | |
| CVE-2026-85594 | Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware | < 3.7.11 ≥ 3.7.1 ≤ 3.7.12 | 7.0 | — | 2026-09-04 | |
| CVE-2026-71327 | Traefik: Gateway API route identity collision allows cross-namespace backend hijacking | ≥ 3.0.0 < 3.6.25 ≥ 3.7.0 < 3.7.10 * | 7.6 | — | 2026-08-07 | |
| CVE-2026-71326 | Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing | ≥ 3.6.11 < 3.6.25 ≥ 3.7.0 < 3.7.10 * | 2.1 | — | 2026-08-07 | |
| CVE-2026-71325 | Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef | < 2.11.54 ≥ 3.0.0 < 3.6.25 ≥ 3.7.0 ≤ 3.7.10 | 4.8 | — | 2026-08-07 | |
| CVE-2026-71324 | Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool | < 2.11.53 ≥ 3.0.0 < 3.6.24 ≥ 3.7.0 < 3.7.9 | 7.0 | — | 2026-08-07 | |
| CVE-2026-67309 | Traefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypass | ≥ 3.7.0 < 3.7.8 * | 7.8 | — | 2026-08-01 | |
| CVE-2026-65602 | Traefik before 3.6.23 IngressRouteTCP ServersTransport Namespace Bypass | ≥ 3.6.0 < 3.6.23 ≥ 3.7.0 < 3.7.7 * | 5.3 | — | 2026-07-22 | |
| CVE-2026-65601 | Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef | ≥ 3.7.0 < 3.7.7 * | 5.3 | — | 2026-07-22 | |
| CVE-2026-65600 | Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex | < 2.11.52 ≥ 3.6.0 < 3.6.23 ≥ 3.7.0 < 3.7.7 | 7.8 | — | 2026-07-22 | |
| CVE-2026-54763 | Traefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth | < 2.11.51 ≥ 3.0.0 < 3.6.22 ≥ 3.7.0 < 3.7.6 | 7.8 | — | 2026-07-07 | |
| CVE-2026-54765 | Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port | ≥ 3.7.0 < 3.7.6 * | 6.3 | — | 2026-07-07 | |
| CVE-2026-54764 | ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader... | < 2.11.51 ≥ 3.0.0 < 3.6.22 ≥ 3.7.0 < 3.7.6 | 6.9 | — | 2026-07-07 | |
| CVE-2026-54762 | Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails | ≥ 3.7.0 < 3.7.5 * | 5.9 | — | 2026-06-24 | |
| CVE-2026-54761 | Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose in... | < 3.6.21 ≥ 3.7.0 < 3.7.5 ≤ 1.7.34 | 6.0 | — | 2026-06-24 | |
| CVE-2026-53622 | Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts | < 3.7.3 ≤ 1.7.34 * | 7.8 | — | 2026-06-24 | |
| CVE-2026-48491 | Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass | ≥ 3.7.0 < 3.7.3 * | 7.8 | — | 2026-06-24 | |
| CVE-2026-48020 | Traefik StripPrefix Route-Level Auth Bypass via Path Normalization | < 2.11.48 ≥ 3.0.0 < 3.6.19 ≥ 3.7.0 < 3.7.3 | 7.8 | — | 2026-06-24 | |
| CVE-2023-54365 | Traefik - Denial of Service via HTTP/2 Request Handling | < 2.10.5 = 3.0.0 ≥ 3.0.0-beta1 < 3.0.0-beta4 | 8.7 | — | 2026-06-23 | |
| CVE-2026-44774 | Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST... | < 2.11.46 ≥ 3.0.0 < 3.6.17 ≥ 3.7.0 < 3.7.1 | 6.4 | — | 2026-05-16 | |
| CVE-2026-41181 | Traefik: Errors middleware forwards Authorization and Cookie headers to separate error page service | < 2.11.44 ≥ 3.0.0 < 3.6.15 = 3.7.0 | 6.9 | — | 2026-05-16 | |
| CVE-2026-41263 | Traefik: BasicAuth middleware: timing side-channel vulnerability | < 2.11.43 ≥ 3.0.0 < 3.6.14 = 3.7.0 | 6.3 | — | 2026-05-01 | |
| CVE-2026-40912 | Traefik: StripPrefixRegex auth bypass via Path/RawPath desync | < 2.11.43 ≥ 3.0.0 < 3.6.14 = 3.7.0 | 7.8 | — | 2026-05-01 | |
| CVE-2026-39858 | Traefik: Forwarded alias spoofing top pre-auth decision bypass | < 2.11.43 ≥ 3.0.0 < 3.6.14 = 3.7.0 | 7.8 | — | 2026-05-01 | |
| CVE-2026-35051 | Traefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth | < 2.11.43 ≥ 3.0.0 < 3.6.14 = 3.7.0 | 7.8 | — | 2026-05-01 | |
| CVE-2026-41174 | Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding | < 2.11.43 ≥ 3.0.0 < 3.6.14 = 3.7.0 | 4.8 | — | 2026-05-01 | |
| CVE-2026-33433 | Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField | < 2.11.42 ≥ 3.0.0 < 3.6.12 = 3.7.0 | 5.1 | — | 2026-03-27 | |
| CVE-2026-32695 | Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass | < 3.6.11 = 3.7.0 * | 6.3 | — | 2026-03-27 | |
| CVE-2026-32595 | Traefik: BasicAuth Middleware Timing Attack Allows Username Enumeration | < 2.11.41 ≥ 3.0.0 ≤ 3.6.11 = 3.7.0 | 6.3 | — | 2026-03-20 | |
| CVE-2026-32305 | Traefik mTLS bypass via fragmented ClientHello SNI extraction failure | < 2.11.41 ≥ 3.0.0 ≤ 3.6.11 = 3.7.0 | 7.8 | — | 2026-03-20 | |
| CVE-2026-29777 | Traefik has a kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values | < 3.6.10 ≤ 1.7.34 * | 6.1 | — | 2026-03-12 | |
| CVE-2026-29054 | Traefik: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-... | ≥ 2.11.9 < 2.11.38 ≥ 3.1.3 < 3.6.9 * | 7.5 | — | 2026-03-06 | |
| CVE-2026-26999 | Traefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (slowloris doS) | < 2.11.38 ≥ 3.0.0 < 3.6.9 * | 7.5 | — | 2026-03-06 |
Suivez ces versions sur vos propres serveurs
InfraGuard collecte les versions logicielles installées sur chaque serveur et signale celles qui présentent des vulnérabilités connues. Auto-hébergé : rien ne quitte votre réseau.
Données : CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (voir EPSS sur https://www.first.org/epss), endoflife.date. Liste des logiciels : awesome-selfhosted (CC BY-SA 3.0).