취약점 이력이 말해 주는 것
Traefik은 알려진 악용된 취약점(KEV) 카탈로그의 1개 항목을 포함하여 최대 CVSS 점수 9.3의 CVE 85개가 기록되어 있습니다. 해당 소프트웨어와 관련된 최신 CVE의 날짜는 2026-10-30입니다.
안전하게 운영하려면
운영자는 3.7과 같은 지원되는 릴리스 라인을 유지하고 실행 중인 버전을 보안 업데이트와 비교하여 지속적으로 추적해야 합니다.
설치된 버전 확인
traefik version영향받는 버전 라인
- 3.7 CVE 55건
- 3.6 CVE 51건 지원 종료
- 3.5 CVE 48건 지원 종료
- 3.4 CVE 49건 지원 종료
- 3.3 CVE 48건 지원 종료
- 3.2 CVE 49건 지원 종료
- 3.1 CVE 48건 지원 종료
- 3.0 CVE 53건 KEV 1 지원 종료
- 2.11 CVE 50건 지원 종료
- 2.10 CVE 51건 KEV 1 지원 종료
- 2.9 CVE 54건 KEV 1 지원 종료
- 2.8 CVE 54건 KEV 1 지원 종료
- 2.6 CVE 52건 KEV 1 지원 종료
- 2.4 CVE 54건 KEV 1 지원 종료
- 2.3 CVE 55건 KEV 1 지원 종료
- 2.2 CVE 55건 KEV 1 지원 종료
- 2.1 CVE 55건 KEV 1 지원 종료
- 2.0 CVE 56건 KEV 1 지원 종료
- 1.7 CVE 57건 KEV 1 지원 종료
- 1.6 CVE 57건 KEV 1
- 1.5 CVE 56건 KEV 1
- 1.0 CVE 56건 KEV 1
알려진 취약점
| CVE | 제목 | 영향 버전 | CVSS | 악용 | EPSS | 공개일 |
|---|---|---|---|---|---|---|
| CVE-2023-44487 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can... | < 2.10.5 = 3.0.0 | 7.5 | KEV | 100.0% | 2023-10-10 |
| CVE-2026-121966 | Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak | < 2.11.60 ≥ 3.0.0 < 3.7.16 | 7.0 | — | 2026-11-05 | |
| CVE-2026-119573 | Traefik 3.7.11 before 3.7.15 Cross-Namespace Authorization Bypass via auth-tls-secret | ≥ 3.7.11 < 3.7.15 | 2.1 | — | 2026-10-30 | |
| CVE-2026-119574 | Traefik 3.2.0 before 3.7.15 FastProxy Data Race Denial of Service | ≥ 3.2.0 < 3.7.15 | 8.2 | — | 2026-10-30 | |
| CVE-2026-119572 | Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider | ≥ 3.7.0-ea.1 < 3.7.15 | 7.0 | — | 2026-10-30 | |
| CVE-2026-114656 | Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher | < 2.11.58 ≥ 3.0.0 < 3.7.13 | 6.9 | — | 2026-10-22 | |
| CVE-2026-114642 | Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper | ≥ 2.11.0 < 2.11.58 ≥ 3.0.0 < 3.7.14 | 7.0 | — | 2026-10-22 | |
| CVE-2026-114641 | Traefik before 2.11.58 and 3.7.14 Race Condition in NTLM/Kerberos Round Tripper | ≥ 2.11.0 < 2.11.58 ≥ 3.0.0 < 3.7.14 | 6.3 | — | 2026-10-22 | |
| CVE-2026-114639 | Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool | ≥ 2.11.0 < 2.11.58 ≥ 3.0.0 < 3.7.14 | 7.0 | — | 2026-10-22 | |
| CVE-2026-114640 | Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router | ≥ 3.7.0 < 3.7.14 | 7.0 | — | 2026-10-22 | |
| CVE-2026-114638 | Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision | ≥ 3.7.0 < 3.7.14 | 7.0 | — | 2026-10-22 | |
| CVE-2026-114636 | Traefik v3.7.13 Authentication Bypass via ssl-passthrough Ingress HTTP Router | = 3.7.13 ≥ 3.7.13 < 3.7.14 | 7.0 | — | 2026-10-22 | |
| CVE-2026-114637 | Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leak | ≥ 3.2.0 < 3.7.14 | 7.0 | — | 2026-10-22 | |
| CVE-2026-114635 | Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme | < 2.11.58 ≥ 3.0.0 < 3.7.14 | 7.0 | — | 2026-10-22 | |
| CVE-2026-112778 | Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations | < 2.11.46 ≥ 3.0.0 < 3.6.16 = 3.7.0 | 6.4 | — | 2026-10-20 | |
| CVE-2026-88010 | Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle | ≥ 3.6.11 < 3.7.13 * | 6.3 | — | 2026-09-23 | |
| CVE-2026-88012 | Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded | ≥ 2.8.2 < 2.11.56 ≥ 3.0.0 < 3.7.12 * | 5.3 | — | 2026-09-11 | |
| CVE-2026-88011 | Traefik: ForwardAuth identity spoofing via dot-form header alias | < 2.11.56 ≥ 3.0.0 < 3.7.12 * | 5.3 | — | 2026-09-11 | |
| CVE-2026-88009 | Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing... | < 2.11.57 ≥ 3.0.0 < 3.7.13 * | 8.8 | — | 2026-09-11 | |
| CVE-2026-88008 | Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Author... | ≥ 2.11.26 < 2.11.57 ≥ 3.4.2 < 3.7.13 * | 7.0 | — | 2026-09-10 | |
| CVE-2026-88007 | Traefik HTTP/3 Backend NTLM Connection Reuse | ≥ 2.8.2 < 2.11.56 ≥ 3.0.0 < 3.7.12 * | 9.1 | — | 2026-09-10 | |
| CVE-2026-88004 | Traefik entrypoint header-name sanitization bypassed via request trailers | ≥ 3.2.0 < 3.7.13 * | 7.0 | — | 2026-09-10 | |
| CVE-2026-88878 | Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass | ≥ 2.8.2 < 2.11.56 ≥ 3.0.0 < 3.7.12 * | 6.9 | — | 2026-09-10 | |
| CVE-2026-88879 | Traefik before v2.11.56 Identity Spoofing via Header Alias | ≥ 1.0 < 2.11.56 ≥ 3.0.0 < 3.7.12 * | 5.3 | — | 2026-09-10 | |
| CVE-2026-88877 | Traefik v3.7.0 Authentication Bypass via from-to-www-redirect | ≥ 3.7.0 < 3.7.12 ≥ 3.7.0 ≤ 3.7.13 | 9.3 | — | 2026-09-10 | |
| CVE-2026-85596 | Traefik v3.7 Authentication Bypass via TLS Option Conflict | ≥ 3.7.0 < 3.7.11 ≥ 3.7.0 ≤ 3.7.10 | 8.2 | — | 2026-09-04 | |
| CVE-2026-85597 | Traefik before v2.11.55 and v3.0.0 through v3.7.10 mTLS Bypass via TLS Option Conflict | < 2.11.55 ≥ 3.0.0 < 3.7.11 ≥ 3.0.0 ≤ 3.7.10 | 8.2 | — | 2026-09-04 | |
| CVE-2026-85595 | Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth | < 2.11.55 ≥ 3.0.0 < 3.7.11 ≥ 3.0.0 ≤ 3.7.10 | 9.3 | — | 2026-09-04 | |
| CVE-2026-85594 | Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware | < 3.7.11 ≥ 3.7.1 ≤ 3.7.12 | 7.0 | — | 2026-09-04 | |
| CVE-2026-71327 | Traefik: Gateway API route identity collision allows cross-namespace backend hijacking | ≥ 3.0.0 < 3.6.25 ≥ 3.7.0 < 3.7.10 * | 7.6 | — | 2026-08-07 | |
| CVE-2026-71326 | Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing | ≥ 3.6.11 < 3.6.25 ≥ 3.7.0 < 3.7.10 * | 2.1 | — | 2026-08-07 | |
| CVE-2026-71325 | Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef | < 2.11.54 ≥ 3.0.0 < 3.6.25 ≥ 3.7.0 ≤ 3.7.10 | 4.8 | — | 2026-08-07 | |
| CVE-2026-71324 | Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool | < 2.11.53 ≥ 3.0.0 < 3.6.24 ≥ 3.7.0 < 3.7.9 | 7.0 | — | 2026-08-07 | |
| CVE-2026-67309 | Traefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypass | ≥ 3.7.0 < 3.7.8 * | 7.8 | — | 2026-08-01 | |
| CVE-2026-65602 | Traefik before 3.6.23 IngressRouteTCP ServersTransport Namespace Bypass | ≥ 3.6.0 < 3.6.23 ≥ 3.7.0 < 3.7.7 * | 5.3 | — | 2026-07-22 | |
| CVE-2026-65601 | Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef | ≥ 3.7.0 < 3.7.7 * | 5.3 | — | 2026-07-22 | |
| CVE-2026-65600 | Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex | < 2.11.52 ≥ 3.6.0 < 3.6.23 ≥ 3.7.0 < 3.7.7 | 7.8 | — | 2026-07-22 | |
| CVE-2026-54763 | Traefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth | < 2.11.51 ≥ 3.0.0 < 3.6.22 ≥ 3.7.0 < 3.7.6 | 7.8 | — | 2026-07-07 | |
| CVE-2026-54765 | Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port | ≥ 3.7.0 < 3.7.6 * | 6.3 | — | 2026-07-07 | |
| CVE-2026-54764 | ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader... | < 2.11.51 ≥ 3.0.0 < 3.6.22 ≥ 3.7.0 < 3.7.6 | 6.9 | — | 2026-07-07 | |
| CVE-2026-54762 | Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails | ≥ 3.7.0 < 3.7.5 * | 5.9 | — | 2026-06-24 | |
| CVE-2026-54761 | Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose in... | < 3.6.21 ≥ 3.7.0 < 3.7.5 ≤ 1.7.34 | 6.0 | — | 2026-06-24 | |
| CVE-2026-53622 | Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts | < 3.7.3 ≤ 1.7.34 * | 7.8 | — | 2026-06-24 | |
| CVE-2026-48491 | Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass | ≥ 3.7.0 < 3.7.3 * | 7.8 | — | 2026-06-24 | |
| CVE-2026-48020 | Traefik StripPrefix Route-Level Auth Bypass via Path Normalization | < 2.11.48 ≥ 3.0.0 < 3.6.19 ≥ 3.7.0 < 3.7.3 | 7.8 | — | 2026-06-24 | |
| CVE-2023-54365 | Traefik - Denial of Service via HTTP/2 Request Handling | < 2.10.5 = 3.0.0 ≥ 3.0.0-beta1 < 3.0.0-beta4 | 8.7 | — | 2026-06-23 | |
| CVE-2026-44774 | Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST... | < 2.11.46 ≥ 3.0.0 < 3.6.17 ≥ 3.7.0 < 3.7.1 | 6.4 | — | 2026-05-16 | |
| CVE-2026-41181 | Traefik: Errors middleware forwards Authorization and Cookie headers to separate error page service | < 2.11.44 ≥ 3.0.0 < 3.6.15 = 3.7.0 | 6.9 | — | 2026-05-16 | |
| CVE-2026-41263 | Traefik: BasicAuth middleware: timing side-channel vulnerability | < 2.11.43 ≥ 3.0.0 < 3.6.14 = 3.7.0 | 6.3 | — | 2026-05-01 | |
| CVE-2026-40912 | Traefik: StripPrefixRegex auth bypass via Path/RawPath desync | < 2.11.43 ≥ 3.0.0 < 3.6.14 = 3.7.0 | 7.8 | — | 2026-05-01 | |
| CVE-2026-39858 | Traefik: Forwarded alias spoofing top pre-auth decision bypass | < 2.11.43 ≥ 3.0.0 < 3.6.14 = 3.7.0 | 7.8 | — | 2026-05-01 | |
| CVE-2026-35051 | Traefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth | < 2.11.43 ≥ 3.0.0 < 3.6.14 = 3.7.0 | 7.8 | — | 2026-05-01 | |
| CVE-2026-41174 | Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding | < 2.11.43 ≥ 3.0.0 < 3.6.14 = 3.7.0 | 4.8 | — | 2026-05-01 | |
| CVE-2026-33433 | Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField | < 2.11.42 ≥ 3.0.0 < 3.6.12 = 3.7.0 | 5.1 | — | 2026-03-27 | |
| CVE-2026-32695 | Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass | < 3.6.11 = 3.7.0 * | 6.3 | — | 2026-03-27 | |
| CVE-2026-32595 | Traefik: BasicAuth Middleware Timing Attack Allows Username Enumeration | < 2.11.41 ≥ 3.0.0 ≤ 3.6.11 = 3.7.0 | 6.3 | — | 2026-03-20 | |
| CVE-2026-32305 | Traefik mTLS bypass via fragmented ClientHello SNI extraction failure | < 2.11.41 ≥ 3.0.0 ≤ 3.6.11 = 3.7.0 | 7.8 | — | 2026-03-20 | |
| CVE-2026-29777 | Traefik has a kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values | < 3.6.10 ≤ 1.7.34 * | 6.1 | — | 2026-03-12 | |
| CVE-2026-29054 | Traefik: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-... | ≥ 2.11.9 < 2.11.38 ≥ 3.1.3 < 3.6.9 * | 7.5 | — | 2026-03-06 | |
| CVE-2026-26999 | Traefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (slowloris doS) | < 2.11.38 ≥ 3.0.0 < 3.6.9 * | 7.5 | — | 2026-03-06 |
내 서버의 버전을 직접 추적하세요
InfraGuard 는 모든 서버에 설치된 소프트웨어 버전을 수집하고, 알려진 취약점이 있는 버전을 알려 줍니다. 자체 호스팅이라 데이터가 내 네트워크를 벗어나지 않습니다.
데이터: CVE List(CVE® Program), NVD, CISA KEV, FIRST EPSS(EPSS 는 https://www.first.org/epss 참고), endoflife.date. 소프트웨어 목록: awesome-selfhosted(CC BY-SA 3.0).