{"schema_version":1,"title":"github.com/traefik/traefik/v2 (Go) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 73 vulnerabilities in github.com/traefik/traefik/v2 (Go): 0 in the last 7 days and 18 in the last 90 days, 5 of them critical and 0 exploited in the wild. The most recent, CVE-2026-88012, was published on 10 September 2026.","url":"https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2","json_url":"https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":17,"all_time":73,"critical":5,"exploited":0,"last_7_days":0,"last_30_days":6,"last_90_days":18,"last_365_days":47},"latest":[{"cve":"CVE-2026-88012","cvss":5.3,"epss":0.0052,"slug":"cve-2026-88012-traefik-readtimeout-not-enforced-on-http-3-connections","title":"Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPo","severity":"medium","exploited":false,"published_at":"2026-09-10T16:18:08.067+00:00","url":"https://junglewise.ai/threats/cve-2026-88012-traefik-readtimeout-not-enforced-on-http-3-connections"},{"cve":"CVE-2026-88011","cvss":8.1,"epss":0.0042,"slug":"cve-2026-88011-traefik-forwardauth-identity-spoofing-via-header-alias","title":"Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form he","severity":"high","exploited":false,"published_at":"2026-09-10T16:18:07.933+00:00","url":"https://junglewise.ai/threats/cve-2026-88011-traefik-forwardauth-identity-spoofing-via-header-alias"},{"cve":"CVE-2026-88009","cvss":8.2,"epss":0.0044,"slug":"cve-2026-88009-traefik-rootless-http-1-request-target-routing-bypass","title":"Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request targ","severity":"high","exploited":false,"published_at":"2026-09-10T16:18:07.78+00:00","url":"https://junglewise.ai/threats/cve-2026-88009-traefik-rootless-http-1-request-target-routing-bypass"},{"cve":"CVE-2026-88008","cvss":9.1,"epss":0.0049,"slug":"cve-2026-88008-traefik-http-request-smuggling-via-unrestricted-protocol-upgrade","title":"Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Co","severity":"critical","exploited":false,"published_at":"2026-09-10T15:17:56.433+00:00","url":"https://junglewise.ai/threats/cve-2026-88008-traefik-http-request-smuggling-via-unrestricted-protocol-upgrade"},{"cve":"CVE-2026-88007","cvss":9.1,"epss":0.006,"slug":"cve-2026-88007-traefik-http-3-backend-ntlm-connection-reuse","title":"Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does","severity":"critical","exploited":false,"published_at":"2026-09-10T15:17:56.183+00:00","url":"https://junglewise.ai/threats/cve-2026-88007-traefik-http-3-backend-ntlm-connection-reuse"},{"cve":"CVE-2026-88004","cvss":7.4,"epss":0.0045,"slug":"cve-2026-88004-traefik-entrypoint-header-sanitization-bypass-via-request","title":"Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, u","severity":"high","exploited":false,"published_at":"2026-09-10T15:17:54.94+00:00","url":"https://junglewise.ai/threats/cve-2026-88004-traefik-entrypoint-header-sanitization-bypass-via-request"},{"cve":"CVE-2026-67309","cvss":4,"epss":0.0066,"slug":"cve-2026-67309-traefik-auth-bypass-via-path-traversal-in-kubernetes-ingress","title":"Traefik auth bypass via path traversal in Kubernetes Ingress NGINX provider","severity":"high","exploited":false,"published_at":"2026-08-06T16:45:28+00:00","url":"https://junglewise.ai/threats/cve-2026-67309-traefik-auth-bypass-via-path-traversal-in-kubernetes-ingress"},{"cve":"CVE-2026-71325","cvss":4,"epss":0.0016,"slug":"cve-2026-71325-traefik-namespace-isolation-bypass-in-kubernetes-crd","title":"Traefik namespace isolation bypass in Kubernetes CRD TraefikService","severity":"medium","exploited":false,"published_at":"2026-08-06T16:38:37+00:00","url":"https://junglewise.ai/threats/cve-2026-71325-traefik-namespace-isolation-bypass-in-kubernetes-crd"},{"cve":"CVE-2026-71327","cvss":8.2,"epss":0.0048,"slug":"cve-2026-71327-traefik-proxy-cross-namespace-route-hijacking-via-identity","title":"Traefik Proxy cross-namespace route hijacking via identity collision","severity":"high","exploited":false,"published_at":"2026-08-06T16:38:18+00:00","url":"https://junglewise.ai/threats/cve-2026-71327-traefik-proxy-cross-namespace-route-hijacking-via-identity"},{"cve":"CVE-2026-71326","cvss":4,"epss":0.0034,"slug":"cve-2026-71326-traefik-basicauth-identity-spoofing-via-singleflight-key","title":"Traefik BasicAuth identity spoofing via singleflight key collision","severity":"medium","exploited":false,"published_at":"2026-08-06T16:34:38+00:00","url":"https://junglewise.ai/threats/cve-2026-71326-traefik-basicauth-identity-spoofing-via-singleflight-key"},{"cve":"CVE-2026-71324","cvss":4,"epss":0.0069,"slug":"cve-2026-71324-traefik-response-poisoning-via-proxied-connect-in-shared","title":"Traefik response poisoning via proxied CONNECT in shared connection pool","severity":"high","exploited":false,"published_at":"2026-08-06T15:56:40+00:00","url":"https://junglewise.ai/threats/cve-2026-71324-traefik-response-poisoning-via-proxied-connect-in-shared"},{"cvss":4,"slug":"duplicate-advisory-traefik-authentication-bypass-via-path-traversal-in-fb7fb662","title":"Duplicate Advisory: Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware","severity":"medium","exploited":false,"published_at":"2026-07-22T12:32:18+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-traefik-authentication-bypass-via-path-traversal-in-fb7fb662"},{"cvss":7.8,"slug":"traefik-auth-bypass-via-path-traversal-in-replacepathregex-middleware-57873860","title":"Traefik auth bypass via path traversal in ReplacePathRegex middleware","severity":"high","exploited":false,"published_at":"2026-07-22T12:32:18+00:00","url":"https://junglewise.ai/threats/traefik-auth-bypass-via-path-traversal-in-replacepathregex-middleware-57873860"},{"cve":"CVE-2026-65602","cvss":4,"epss":0.0033,"slug":"cve-2026-65602-traefik-authorization-bypass-in-ingressroutetcp-cross-provider","title":"Traefik authorization bypass in IngressRouteTCP cross-provider references","severity":"medium","exploited":false,"published_at":"2026-07-22T12:18:20.56+00:00","url":"https://junglewise.ai/threats/cve-2026-65602-traefik-authorization-bypass-in-ingressroutetcp-cross-provider"},{"cve":"CVE-2026-65600","cvss":9.1,"epss":0.0062,"slug":"cve-2026-65600-traefik-authentication-bypass-in-replacepathregex-middleware","title":"Traefik authentication bypass in ReplacePathRegex middleware","severity":"critical","exploited":false,"published_at":"2026-07-22T12:18:20.297+00:00","url":"https://junglewise.ai/threats/cve-2026-65600-traefik-authentication-bypass-in-replacepathregex-middleware"},{"cve":"CVE-2026-54765","cvss":4,"epss":0.0035,"slug":"cve-2026-54765-traefik-incorrect-authorization-via-backendref-filter-collision","title":"Traefik incorrect authorization via backendRef filter collision in Kubernetes Gateway API","severity":"medium","exploited":false,"published_at":"2026-07-06T21:16:57.067+00:00","url":"https://junglewise.ai/threats/cve-2026-54765-traefik-incorrect-authorization-via-backendref-filter-collision"},{"cve":"CVE-2026-54764","cvss":5.8,"epss":0.0028,"slug":"cve-2026-54764-traefik-proxy-authorization-bypass-in-forwardauth-middleware","title":"Traefik Proxy authorization bypass in ForwardAuth middleware","severity":"medium","exploited":false,"published_at":"2026-07-06T21:16:56.93+00:00","url":"https://junglewise.ai/threats/cve-2026-54764-traefik-proxy-authorization-bypass-in-forwardauth-middleware"},{"cve":"CVE-2026-54763","cvss":4,"epss":0.0024,"slug":"cve-2026-54763-traefik-proxy-authentication-bypass-via-underscore-header","title":"Traefik Proxy authentication bypass via underscore header spoofing","severity":"high","exploited":false,"published_at":"2026-07-06T21:16:56.787+00:00","url":"https://junglewise.ai/threats/cve-2026-54763-traefik-proxy-authentication-bypass-via-underscore-header"},{"cve":"CVE-2026-41174","cvss":3.1,"epss":0.0028,"slug":"cve-2026-41174-traefik-kubernetes-crd-allows-unauthorized-cross-namespace","title":"GO-2026-5760 - Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding in github.com/traefik/traefik","severity":"low","exploited":false,"published_at":"2026-06-25T22:34:41+00:00","url":"https://junglewise.ai/threats/cve-2026-41174-traefik-kubernetes-crd-allows-unauthorized-cross-namespace"},{"cve":"CVE-2026-41263","cvss":3.1,"epss":0.0041,"slug":"cve-2026-41263-traefik-a-timing-side-channel-vulnerability-allows-for-valid","title":"GO-2026-5195 - Traefik: A timing side-channel vulnerability allows for valid username enumeration via BasicAuth middleware in github.com/traefik/traefik","severity":"low","exploited":false,"published_at":"2026-06-25T18:43:15+00:00","url":"https://junglewise.ai/threats/cve-2026-41263-traefik-a-timing-side-channel-vulnerability-allows-for-valid"},{"cve":"CVE-2026-54762","cvss":3.1,"epss":0.0043,"slug":"cve-2026-54762-traefik-fail-open-in-kubernetes-ingress-nginx-provider-auth","title":"Traefik fail open in Kubernetes Ingress NGINX provider auth resolution","severity":"medium","exploited":false,"published_at":"2026-06-23T20:16:49.997+00:00","url":"https://junglewise.ai/threats/cve-2026-54762-traefik-fail-open-in-kubernetes-ingress-nginx-provider-auth"},{"cve":"CVE-2026-54761","cvss":3.1,"epss":0.0037,"slug":"cve-2026-54761-traefik-authorization-bypass-in-kubernetes-gateway","title":"Traefik authorization bypass in Kubernetes Gateway crossProviderNamespaces","severity":"medium","exploited":false,"published_at":"2026-06-23T20:16:49.867+00:00","url":"https://junglewise.ai/threats/cve-2026-54761-traefik-authorization-bypass-in-kubernetes-gateway"},{"cve":"CVE-2026-53622","cvss":3.1,"epss":0.0063,"slug":"cve-2026-53622-traefik-mtls-bypass-in-http-3-via-exact-sni-lookup-failure","title":"Traefik mTLS bypass in HTTP/3 via exact SNI lookup failure","severity":"high","exploited":false,"published_at":"2026-06-23T20:16:48.777+00:00","url":"https://junglewise.ai/threats/cve-2026-53622-traefik-mtls-bypass-in-http-3-via-exact-sni-lookup-failure"},{"cve":"CVE-2026-48491","cvss":3.1,"epss":0.0036,"slug":"cve-2026-48491-traefik-mtls-bypass-in-snicheck-via-wildcard-domain-fronting","title":"Traefik mTLS bypass in SNICheck via wildcard domain fronting","severity":"high","exploited":false,"published_at":"2026-06-23T20:16:48.123+00:00","url":"https://junglewise.ai/threats/cve-2026-48491-traefik-mtls-bypass-in-snicheck-via-wildcard-domain-fronting"},{"cve":"CVE-2026-48020","cvss":3.1,"epss":0.0078,"slug":"cve-2026-48020-traefik-auth-bypass-via-path-normalization-in-stripprefix","title":"Traefik auth bypass via path normalization in StripPrefix middleware","severity":"high","exploited":false,"published_at":"2026-06-23T20:16:47.993+00:00","url":"https://junglewise.ai/threats/cve-2026-48020-traefik-auth-bypass-via-path-normalization-in-stripprefix"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":1,"exploited":0,"vulnerabilities":4},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":5},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":2,"exploited":0,"vulnerabilities":6},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"github.com/siyuan-note/siyuan/kernel (Go)","slug":"github-com-siyuan-note-siyuan-kernel","vulnerabilities":83,"url":"https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel"},{"name":"code.gitea.io/gitea (Go)","slug":"code-gitea-io-gitea","vulnerabilities":76,"url":"https://junglewise.ai/threats/technologies/code-gitea-io-gitea"},{"name":"github.com/rclone/rclone (Go)","slug":"github-com-rclone-rclone","vulnerabilities":26,"url":"https://junglewise.ai/threats/technologies/github-com-rclone-rclone"},{"name":"gogs.io/gogs (Go)","slug":"gogs-io-gogs","vulnerabilities":25,"url":"https://junglewise.ai/threats/technologies/gogs-io-gogs"},{"name":"github.com/filebrowser/filebrowser/v2 (Go)","slug":"github-com-filebrowser-filebrowser-v2","vulnerabilities":18,"url":"https://junglewise.ai/threats/technologies/github-com-filebrowser-filebrowser-v2"},{"name":"github.com/fission/fission (Go)","slug":"github-com-fission-fission","vulnerabilities":18,"url":"https://junglewise.ai/threats/technologies/github-com-fission-fission"},{"name":"github.com/klever-io/klever-go (Go)","slug":"github-com-klever-io-klever-go","vulnerabilities":18,"url":"https://junglewise.ai/threats/technologies/github-com-klever-io-klever-go"},{"name":"code.vikunja.io/api (Go)","slug":"code-vikunja-io-api","vulnerabilities":15,"url":"https://junglewise.ai/threats/technologies/code-vikunja-io-api"},{"name":"github.com/cloudreve/Cloudreve/v4 (Go)","slug":"github-com-cloudreve-cloudreve-v4","vulnerabilities":15,"url":"https://junglewise.ai/threats/technologies/github-com-cloudreve-cloudreve-v4"},{"name":"github.com/gotenberg/gotenberg/v8 (Go)","slug":"github-com-gotenberg-gotenberg-v8","vulnerabilities":14,"url":"https://junglewise.ai/threats/technologies/github-com-gotenberg-gotenberg-v8"},{"name":"github.com/nezhahq/nezha (Go)","slug":"github-com-nezhahq-nezha","vulnerabilities":14,"url":"https://junglewise.ai/threats/technologies/github-com-nezhahq-nezha"},{"name":"github.com/fleetdm/fleet/v4 (Go)","slug":"github-com-fleetdm-fleet-v4","vulnerabilities":13,"url":"https://junglewise.ai/threats/technologies/github-com-fleetdm-fleet-v4"}],"technology":{"hub":true,"name":"github.com/traefik/traefik/v2 (Go)","slug":"github-com-traefik-traefik-v2","vendor":{"name":"Go","slug":"go","url":"https://junglewise.ai/threats/vendors/go"},"aliases":[],"homepage":"https://traefik.io/traefik/","repo_url":"https://github.com/traefik/traefik","description":"An HTTP reverse proxy and load balancer for deploying microservices.","url":"https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2"},"most_severe":[{"cve":"CVE-2026-39858","cvss":10,"epss":0.0061,"slug":"cve-2026-39858-traefik-auth-bypass-in-forwardauth-middleware-via-header-spoofing","title":"Traefik auth bypass in ForwardAuth middleware via header spoofing","severity":"critical","exploited":false,"published_at":"2026-04-30T21:16:32.313+00:00","url":"https://junglewise.ai/threats/cve-2026-39858-traefik-auth-bypass-in-forwardauth-middleware-via-header-spoofing"},{"cve":"CVE-2026-35051","cvss":10,"epss":0.0031,"slug":"cve-2026-35051-traefik-auth-bypass-in-forwardauth-middleware-via-header-spoofing","title":"Traefik auth bypass in ForwardAuth middleware via header spoofing","severity":"critical","exploited":false,"published_at":"2026-04-30T21:16:32.047+00:00","url":"https://junglewise.ai/threats/cve-2026-35051-traefik-auth-bypass-in-forwardauth-middleware-via-header-spoofing"},{"cve":"CVE-2026-65600","cvss":9.1,"epss":0.0062,"slug":"cve-2026-65600-traefik-authentication-bypass-in-replacepathregex-middleware","title":"Traefik authentication bypass in ReplacePathRegex middleware","severity":"critical","exploited":false,"published_at":"2026-07-22T12:18:20.297+00:00","url":"https://junglewise.ai/threats/cve-2026-65600-traefik-authentication-bypass-in-replacepathregex-middleware"},{"cve":"CVE-2026-88007","cvss":9.1,"epss":0.006,"slug":"cve-2026-88007-traefik-http-3-backend-ntlm-connection-reuse","title":"Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does","severity":"critical","exploited":false,"published_at":"2026-09-10T15:17:56.183+00:00","url":"https://junglewise.ai/threats/cve-2026-88007-traefik-http-3-backend-ntlm-connection-reuse"},{"cve":"CVE-2026-88008","cvss":9.1,"epss":0.0049,"slug":"cve-2026-88008-traefik-http-request-smuggling-via-unrestricted-protocol-upgrade","title":"Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Co","severity":"critical","exploited":false,"published_at":"2026-09-10T15:17:56.433+00:00","url":"https://junglewise.ai/threats/cve-2026-88008-traefik-http-request-smuggling-via-unrestricted-protocol-upgrade"},{"cve":"CVE-2026-33433","cvss":8.8,"epss":0.0057,"slug":"cve-2026-33433-traefik-identity-spoofing-via-non-canonical-headerfield-in-auth","title":"Traefik identity spoofing via non-canonical headerField in Auth middleware","severity":"high","exploited":false,"published_at":"2026-03-27T15:16:54.98+00:00","url":"https://junglewise.ai/threats/cve-2026-33433-traefik-identity-spoofing-via-non-canonical-headerfield-in-auth"},{"cve":"CVE-2026-40912","cvss":8.2,"epss":0.0072,"slug":"cve-2026-40912-traefik-authentication-bypass-in-stripprefixregex-middleware","title":"Traefik authentication bypass in StripPrefixRegex middleware","severity":"high","exploited":false,"published_at":"2026-04-30T21:16:32.74+00:00","url":"https://junglewise.ai/threats/cve-2026-40912-traefik-authentication-bypass-in-stripprefixregex-middleware"},{"cve":"CVE-2026-71327","cvss":8.2,"epss":0.0048,"slug":"cve-2026-71327-traefik-proxy-cross-namespace-route-hijacking-via-identity","title":"Traefik Proxy cross-namespace route hijacking via identity collision","severity":"high","exploited":false,"published_at":"2026-08-06T16:38:18+00:00","url":"https://junglewise.ai/threats/cve-2026-71327-traefik-proxy-cross-namespace-route-hijacking-via-identity"},{"cve":"CVE-2026-88009","cvss":8.2,"epss":0.0044,"slug":"cve-2026-88009-traefik-rootless-http-1-request-target-routing-bypass","title":"Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request targ","severity":"high","exploited":false,"published_at":"2026-09-10T16:18:07.78+00:00","url":"https://junglewise.ai/threats/cve-2026-88009-traefik-rootless-http-1-request-target-routing-bypass"},{"cve":"CVE-2026-88011","cvss":8.1,"epss":0.0042,"slug":"cve-2026-88011-traefik-forwardauth-identity-spoofing-via-header-alias","title":"Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form he","severity":"high","exploited":false,"published_at":"2026-09-10T16:18:07.933+00:00","url":"https://junglewise.ai/threats/cve-2026-88011-traefik-forwardauth-identity-spoofing-via-header-alias"}],"generated_at":"2026-09-26T16:07:00.132667+00:00"}