CVE-2026-41181: Traefik information disclosure in custom error pages middleware

CVE-2026-41181 · Severity: medium · CVSS 4 · Published 2026-05-15

Traefik, a popular tool for managing web traffic and load balancing, contains a flaw in how it handles custom error pages. When a website encounters an error, Traefik may accidentally send sensitive user information—such as login tokens and session cookies—to the service responsible for displaying the error page. This could allow unauthorized internal services or third-party error handlers to see private user credentials they were never intended to access.

Technologies: github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go), Traefik Labs Traefik Proxy. Vendors: Go, Traefik Labs.

Quick answers

Is CVE-2026-41181 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41181 being exploited in the wild.
How severe is CVE-2026-41181?
Medium severity, with a CVSS score of 4, published 15 May 2026.
Which products and versions are affected?
github.com/traefik/traefik (Go) SEMVER:introduced=0; github.com/traefik/traefik/v2 (Go) SEMVER:introduced=0,fixed=2.11.44; github.com/traefik/traefik/v3 (Go) SEMVER:introduced=0,fixed=3.6.15, SEMVER:introduced=0,fixed=3.6.15,introduced=3.7.0-rc.1,fixed=3.7.0-rc.3; Traefik Labs Traefik Proxy <= 2.11.43, <= 3.6.14, >= 3.7.0-rc.0, <= 3.7.0-rc.2.
Is there a fix for CVE-2026-41181?
Yes. github.com/traefik/traefik/v2 (Go): upgrade to 2.11.44 or later; github.com/traefik/traefik/v3 (Go): upgrade to 3.6.15, 3.7.0-rc.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41181 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41181?
Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/traefik/traefik/v2 (Go): upgrade to 2.11.44 or later
    go get github.com/traefik/traefik/v2@v2.11.44
  • github.com/traefik/traefik/v3 (Go): upgrade to 3.6.15, 3.7.0-rc.3 or later
    go get github.com/traefik/traefik/v3@v3.7.0-rc.3

Technical details

An information disclosure vulnerability exists in Traefik's 'errors' (custom error pages) middleware due to improper header sanitization. When a backend service returns an HTTP status code within a configured error range, the middleware generates a new request to the designated error service. By default, the implementation uses 'utils.CopyHeaders' to clone the entire original request header map into the new request, rather than forwarding only the 'Host' header as documented. This results in the transmission of sensitive 'Authorization' and 'Cookie' headers to the error service. The issue is fixed in versions 2.11.44, 3.6.15, and 3.7.0-rc.3 by introducing the 'errorRequestHeaders' option to control header forwarding.

Affected products

  • Traefik Labs Traefik < 2.11.44, < 3.6.15, < 3.7.0-rc.3

Identifiers

  • CVE-2026-41181
  • GHSA-p6hg-qh38-555r
  • GO-2026-5532

Timeline

  • 2026-04-29: patched: Fixes released in versions 2.11.44 and 3.6.15
  • 2026-05-04: advisory: GitHub Security Advisory GHSA-p6hg-qh38-555r published
  • 2026-05-15: disclosed: CVE-2026-41181 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.