{"schema_version":1,"title":"Traefik vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 26 vulnerabilities in Traefik: 1 in the last 7 days and 18 in the last 90 days, 7 of them critical and 0 exploited in the wild. The most recent, CVE-2026-88010, was published on 22 September 2026. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/traefik","json_url":"https://junglewise.ai/threats/vendors/traefik.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/traefik","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":10,"all_time":26,"critical":7,"exploited":0,"last_7_days":1,"last_30_days":13,"last_90_days":18,"last_365_days":26},"latest":[{"cve":"CVE-2026-88010","cvss":4,"epss":0.0069,"slug":"cve-2026-88010-traefik-basicauth-singleflight-username-enumeration-via-timing","title":"Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basic_auth.g","severity":"medium","exploited":false,"published_at":"2026-09-22T16:18:06.963+00:00","url":"https://junglewise.ai/threats/cve-2026-88010-traefik-basicauth-singleflight-username-enumeration-via-timing"},{"cve":"CVE-2026-88012","cvss":5.3,"epss":0.0052,"slug":"cve-2026-88012-traefik-readtimeout-not-enforced-on-http-3-connections","title":"Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPo","severity":"medium","exploited":false,"published_at":"2026-09-10T16:18:08.067+00:00","url":"https://junglewise.ai/threats/cve-2026-88012-traefik-readtimeout-not-enforced-on-http-3-connections"},{"cve":"CVE-2026-88011","cvss":8.1,"epss":0.0042,"slug":"cve-2026-88011-traefik-forwardauth-identity-spoofing-via-header-alias","title":"Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form he","severity":"high","exploited":false,"published_at":"2026-09-10T16:18:07.933+00:00","url":"https://junglewise.ai/threats/cve-2026-88011-traefik-forwardauth-identity-spoofing-via-header-alias"},{"cve":"CVE-2026-88009","cvss":8.2,"epss":0.0044,"slug":"cve-2026-88009-traefik-rootless-http-1-request-target-routing-bypass","title":"Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request targ","severity":"high","exploited":false,"published_at":"2026-09-10T16:18:07.78+00:00","url":"https://junglewise.ai/threats/cve-2026-88009-traefik-rootless-http-1-request-target-routing-bypass"},{"cve":"CVE-2026-88008","cvss":9.1,"epss":0.0049,"slug":"cve-2026-88008-traefik-http-request-smuggling-via-unrestricted-protocol-upgrade","title":"Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Co","severity":"critical","exploited":false,"published_at":"2026-09-10T15:17:56.433+00:00","url":"https://junglewise.ai/threats/cve-2026-88008-traefik-http-request-smuggling-via-unrestricted-protocol-upgrade"},{"cve":"CVE-2026-88007","cvss":9.1,"epss":0.006,"slug":"cve-2026-88007-traefik-http-3-backend-ntlm-connection-reuse","title":"Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does","severity":"critical","exploited":false,"published_at":"2026-09-10T15:17:56.183+00:00","url":"https://junglewise.ai/threats/cve-2026-88007-traefik-http-3-backend-ntlm-connection-reuse"},{"cve":"CVE-2026-88004","cvss":7.4,"epss":0.0045,"slug":"cve-2026-88004-traefik-entrypoint-header-sanitization-bypass-via-request","title":"Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, u","severity":"high","exploited":false,"published_at":"2026-09-10T15:17:54.94+00:00","url":"https://junglewise.ai/threats/cve-2026-88004-traefik-entrypoint-header-sanitization-bypass-via-request"},{"cve":"CVE-2026-88879","cvss":8.2,"epss":0.003,"slug":"cve-2026-88879-traefik-header-name-aliasing-identity-spoofing","title":"Traefik header name aliasing identity spoofing","severity":"high","exploited":false,"published_at":"2026-09-10T14:17:16.337+00:00","url":"https://junglewise.ai/threats/cve-2026-88879-traefik-header-name-aliasing-identity-spoofing"},{"cve":"CVE-2026-88878","cvss":5.3,"epss":0.0042,"slug":"cve-2026-88878-traefik-http-3-timeout-bypass-in-respondingtimeouts","title":"Traefik HTTP/3 timeout bypass in respondingTimeouts","severity":"medium","exploited":false,"published_at":"2026-09-10T14:17:16.173+00:00","url":"https://junglewise.ai/threats/cve-2026-88878-traefik-http-3-timeout-bypass-in-respondingtimeouts"},{"cve":"CVE-2026-88877","cvss":9.8,"epss":0.0065,"slug":"cve-2026-88877-traefik-authentication-bypass-in-ingress-nginx-provider","title":"Traefik authentication bypass in ingress-nginx provider","severity":"critical","exploited":false,"published_at":"2026-09-10T14:17:16.023+00:00","url":"https://junglewise.ai/threats/cve-2026-88877-traefik-authentication-bypass-in-ingress-nginx-provider"},{"cve":"CVE-2026-85596","cvss":9.8,"epss":0.0044,"slug":"cve-2026-85596-traefik-kubernetes-ingress-nginx-authentication-bypass-via-tls","title":"Traefik Kubernetes Ingress NGINX authentication bypass via TLS option conflict","severity":"critical","exploited":false,"published_at":"2026-09-04T12:17:23.087+00:00","url":"https://junglewise.ai/threats/cve-2026-85596-traefik-kubernetes-ingress-nginx-authentication-bypass-via-tls"},{"cve":"CVE-2026-85595","cvss":9.8,"epss":0.0069,"slug":"cve-2026-85595-traefik-digestauth-authentication-bypass","title":"Traefik digestAuth authentication bypass","severity":"critical","exploited":false,"published_at":"2026-09-04T12:17:22.96+00:00","url":"https://junglewise.ai/threats/cve-2026-85595-traefik-digestauth-authentication-bypass"},{"cve":"CVE-2026-85594","cvss":9.8,"epss":0.0048,"slug":"cve-2026-85594-traefik-kubernetes-ingress-service-middleware","title":"Traefik Kubernetes Ingress service middleware crossProviderNamespaces bypass","severity":"critical","exploited":false,"published_at":"2026-09-04T12:17:22.83+00:00","url":"https://junglewise.ai/threats/cve-2026-85594-traefik-kubernetes-ingress-service-middleware"},{"cve":"CVE-2026-71325","cvss":4,"epss":0.0016,"slug":"cve-2026-71325-traefik-namespace-isolation-bypass-in-kubernetes-crd","title":"Traefik namespace isolation bypass in Kubernetes CRD TraefikService","severity":"medium","exploited":false,"published_at":"2026-08-06T16:38:37+00:00","url":"https://junglewise.ai/threats/cve-2026-71325-traefik-namespace-isolation-bypass-in-kubernetes-crd"},{"cve":"CVE-2026-71324","cvss":4,"epss":0.0069,"slug":"cve-2026-71324-traefik-response-poisoning-via-proxied-connect-in-shared","title":"Traefik response poisoning via proxied CONNECT in shared connection pool","severity":"high","exploited":false,"published_at":"2026-08-06T15:56:40+00:00","url":"https://junglewise.ai/threats/cve-2026-71324-traefik-response-poisoning-via-proxied-connect-in-shared"},{"cvss":5.3,"slug":"traefik-ingressroutetcp-authorization-bypass-in-serverstransport-f9ba5cbc","title":"Traefik IngressRouteTCP authorization bypass in serversTransport references","severity":"medium","exploited":false,"published_at":"2026-07-22T12:32:18+00:00","url":"https://junglewise.ai/threats/traefik-ingressroutetcp-authorization-bypass-in-serverstransport-f9ba5cbc"},{"cve":"CVE-2026-65600","cvss":9.1,"epss":0.0062,"slug":"cve-2026-65600-traefik-authentication-bypass-in-replacepathregex-middleware","title":"Traefik authentication bypass in ReplacePathRegex middleware","severity":"critical","exploited":false,"published_at":"2026-07-22T12:18:20.297+00:00","url":"https://junglewise.ai/threats/cve-2026-65600-traefik-authentication-bypass-in-replacepathregex-middleware"},{"cve":"CVE-2026-54765","cvss":4,"epss":0.0035,"slug":"cve-2026-54765-traefik-incorrect-authorization-via-backendref-filter-collision","title":"Traefik incorrect authorization via backendRef filter collision in Kubernetes Gateway API","severity":"medium","exploited":false,"published_at":"2026-07-06T21:16:57.067+00:00","url":"https://junglewise.ai/threats/cve-2026-54765-traefik-incorrect-authorization-via-backendref-filter-collision"},{"cve":"CVE-2026-54762","cvss":3.1,"epss":0.0043,"slug":"cve-2026-54762-traefik-fail-open-in-kubernetes-ingress-nginx-provider-auth","title":"Traefik fail open in Kubernetes Ingress NGINX provider auth resolution","severity":"medium","exploited":false,"published_at":"2026-06-23T20:16:49.997+00:00","url":"https://junglewise.ai/threats/cve-2026-54762-traefik-fail-open-in-kubernetes-ingress-nginx-provider-auth"},{"cve":"CVE-2026-54761","cvss":3.1,"epss":0.0037,"slug":"cve-2026-54761-traefik-authorization-bypass-in-kubernetes-gateway","title":"Traefik authorization bypass in Kubernetes Gateway crossProviderNamespaces","severity":"medium","exploited":false,"published_at":"2026-06-23T20:16:49.867+00:00","url":"https://junglewise.ai/threats/cve-2026-54761-traefik-authorization-bypass-in-kubernetes-gateway"},{"cve":"CVE-2026-53622","cvss":3.1,"epss":0.0063,"slug":"cve-2026-53622-traefik-mtls-bypass-in-http-3-via-exact-sni-lookup-failure","title":"Traefik mTLS bypass in HTTP/3 via exact SNI lookup failure","severity":"high","exploited":false,"published_at":"2026-06-23T20:16:48.777+00:00","url":"https://junglewise.ai/threats/cve-2026-53622-traefik-mtls-bypass-in-http-3-via-exact-sni-lookup-failure"},{"cve":"CVE-2023-54365","cvss":7.5,"epss":0.0077,"slug":"cve-2023-54365-traefik-denial-of-service-via-http-2-rapid-reset","title":"Traefik denial of service via HTTP/2 Rapid Reset","severity":"high","exploited":false,"published_at":"2026-06-23T13:16:30.42+00:00","url":"https://junglewise.ai/threats/cve-2023-54365-traefik-denial-of-service-via-http-2-rapid-reset"},{"cve":"CVE-2026-44774","cvss":4,"epss":0.0055,"slug":"cve-2026-44774-traefik-unauthorized-rest-provider-exposure-in-kubernetes-gateway","title":"Traefik unauthorized REST provider exposure in Kubernetes Gateway API","severity":"medium","exploited":false,"published_at":"2026-05-15T17:16:48.21+00:00","url":"https://junglewise.ai/threats/cve-2026-44774-traefik-unauthorized-rest-provider-exposure-in-kubernetes-gateway"},{"cve":"CVE-2026-40912","cvss":8.2,"epss":0.0072,"slug":"cve-2026-40912-traefik-authentication-bypass-in-stripprefixregex-middleware","title":"Traefik authentication bypass in StripPrefixRegex middleware","severity":"high","exploited":false,"published_at":"2026-04-30T21:16:32.74+00:00","url":"https://junglewise.ai/threats/cve-2026-40912-traefik-authentication-bypass-in-stripprefixregex-middleware"},{"cve":"CVE-2026-32695","cvss":7.7,"epss":0.0053,"slug":"cve-2026-32695-traefik-router-rule-injection-in-kubernetes-providers","title":"Traefik router rule injection in Kubernetes providers","severity":"high","exploited":false,"published_at":"2026-03-27T14:16:08.537+00:00","url":"https://junglewise.ai/threats/cve-2026-32695-traefik-router-rule-injection-in-kubernetes-providers"}],"vendor":{"hub":true,"name":"Traefik","slug":"traefik","homepage":"https://traefik.io","description":"A company providing cloud-native networking and reverse proxy solutions.","url":"https://junglewise.ai/threats/vendors/traefik"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":1,"exploited":0,"vulnerabilities":2},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":3,"exploited":0,"vulnerabilities":3},{"week":"2026-09-07","critical":3,"exploited":0,"vulnerabilities":9},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":1}],"most_severe":[{"cve":"CVE-2026-85595","cvss":9.8,"epss":0.0069,"slug":"cve-2026-85595-traefik-digestauth-authentication-bypass","title":"Traefik digestAuth authentication bypass","severity":"critical","exploited":false,"published_at":"2026-09-04T12:17:22.96+00:00","url":"https://junglewise.ai/threats/cve-2026-85595-traefik-digestauth-authentication-bypass"},{"cve":"CVE-2026-88877","cvss":9.8,"epss":0.0065,"slug":"cve-2026-88877-traefik-authentication-bypass-in-ingress-nginx-provider","title":"Traefik authentication bypass in ingress-nginx provider","severity":"critical","exploited":false,"published_at":"2026-09-10T14:17:16.023+00:00","url":"https://junglewise.ai/threats/cve-2026-88877-traefik-authentication-bypass-in-ingress-nginx-provider"},{"cve":"CVE-2026-85594","cvss":9.8,"epss":0.0048,"slug":"cve-2026-85594-traefik-kubernetes-ingress-service-middleware","title":"Traefik Kubernetes Ingress service middleware crossProviderNamespaces bypass","severity":"critical","exploited":false,"published_at":"2026-09-04T12:17:22.83+00:00","url":"https://junglewise.ai/threats/cve-2026-85594-traefik-kubernetes-ingress-service-middleware"},{"cve":"CVE-2026-85596","cvss":9.8,"epss":0.0044,"slug":"cve-2026-85596-traefik-kubernetes-ingress-nginx-authentication-bypass-via-tls","title":"Traefik Kubernetes Ingress NGINX authentication bypass via TLS option conflict","severity":"critical","exploited":false,"published_at":"2026-09-04T12:17:23.087+00:00","url":"https://junglewise.ai/threats/cve-2026-85596-traefik-kubernetes-ingress-nginx-authentication-bypass-via-tls"},{"cve":"CVE-2026-65600","cvss":9.1,"epss":0.0062,"slug":"cve-2026-65600-traefik-authentication-bypass-in-replacepathregex-middleware","title":"Traefik authentication bypass in ReplacePathRegex middleware","severity":"critical","exploited":false,"published_at":"2026-07-22T12:18:20.297+00:00","url":"https://junglewise.ai/threats/cve-2026-65600-traefik-authentication-bypass-in-replacepathregex-middleware"},{"cve":"CVE-2026-88007","cvss":9.1,"epss":0.006,"slug":"cve-2026-88007-traefik-http-3-backend-ntlm-connection-reuse","title":"Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does","severity":"critical","exploited":false,"published_at":"2026-09-10T15:17:56.183+00:00","url":"https://junglewise.ai/threats/cve-2026-88007-traefik-http-3-backend-ntlm-connection-reuse"},{"cve":"CVE-2026-88008","cvss":9.1,"epss":0.0049,"slug":"cve-2026-88008-traefik-http-request-smuggling-via-unrestricted-protocol-upgrade","title":"Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Co","severity":"critical","exploited":false,"published_at":"2026-09-10T15:17:56.433+00:00","url":"https://junglewise.ai/threats/cve-2026-88008-traefik-http-request-smuggling-via-unrestricted-protocol-upgrade"},{"cve":"CVE-2026-40912","cvss":8.2,"epss":0.0072,"slug":"cve-2026-40912-traefik-authentication-bypass-in-stripprefixregex-middleware","title":"Traefik authentication bypass in StripPrefixRegex middleware","severity":"high","exploited":false,"published_at":"2026-04-30T21:16:32.74+00:00","url":"https://junglewise.ai/threats/cve-2026-40912-traefik-authentication-bypass-in-stripprefixregex-middleware"},{"cve":"CVE-2026-88009","cvss":8.2,"epss":0.0044,"slug":"cve-2026-88009-traefik-rootless-http-1-request-target-routing-bypass","title":"Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request targ","severity":"high","exploited":false,"published_at":"2026-09-10T16:18:07.78+00:00","url":"https://junglewise.ai/threats/cve-2026-88009-traefik-rootless-http-1-request-target-routing-bypass"},{"cve":"CVE-2026-88879","cvss":8.2,"epss":0.003,"slug":"cve-2026-88879-traefik-header-name-aliasing-identity-spoofing","title":"Traefik header name aliasing identity spoofing","severity":"high","exploited":false,"published_at":"2026-09-10T14:17:16.337+00:00","url":"https://junglewise.ai/threats/cve-2026-88879-traefik-header-name-aliasing-identity-spoofing"}],"generated_at":"2026-09-26T15:07:00.181821+00:00","technologies":[{"name":"Traefik","slug":"traefik","vulnerabilities":29,"url":"https://junglewise.ai/threats/technologies/traefik"}]}