# Traefik vulnerabilities Source: https://junglewise.ai/threats/vendors/traefik Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/traefik.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 37 vulnerabilities in Traefik: 0 in the last 7 days and 19 in the last 90 days, 7 of them critical and 0 exploited in the wild. The most recent, CVE-2026-121966, was published on 4 November 2026. 6 vulnerabilities in the last four weeks, up 500% on the four before (1). 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 6 - Last 90 days: 19 - All time: 37 (7 critical, 0 exploited in the wild) ## About Traefik Open source reverse proxy and load balancer designed for microservices and containerized environments. ## Latest Traefik vulnerabilities - [CVE-2026-121966: Traefik ForwardAuth connection pool identity leak via NTLM/Negotiate](https://junglewise.ai/threats/cve-2026-121966-traefik-2-x-before-2-11-60-and-3-x-before-3-7-16-sends) (high, CVSS 8.7, published 4 Nov 2026) - [CVE-2026-119574: Traefik FastProxy data race in HTTP/1 upgrades](https://junglewise.ai/threats/cve-2026-119574-traefik-from-3-2-0-before-3-7-15-contains-a-data-race-in-the) (medium, CVSS 5.9, published 30 Oct 2026) - [CVE-2026-114656: Traefik authentication bypass in TLS options resolution](https://junglewise.ai/threats/cve-2026-114656-traefik-before-2-11-58-and-3-7-13-contains-an-authentication) (high, CVSS 7.5, published 22 Oct 2026) - [CVE-2026-114642: Traefik NTLM/Kerberos TLS configuration bypass](https://junglewise.ai/threats/cve-2026-114642-traefik-2-11-0-before-2-11-58-and-3-0-0-before-3-7-14-stores-its) (high, CVSS 8.7, published 22 Oct 2026) - [CVE-2026-114639: Traefik authentication bypass in backend connection pool](https://junglewise.ai/threats/cve-2026-114639-traefik-2-11-0-before-2-11-58-and-3-0-0-before-3-7-14-contains) (high, CVSS 8.7, published 22 Oct 2026) - [CVE-2026-112778: Traefik Kubernetes Ingress missing namespace validation in annotations](https://junglewise.ai/threats/cve-2026-112778-traefik-before-2-11-46-3-x-before-3-6-17-and-3-7-0-lack) (info, published 19 Oct 2026) - [CVE-2026-88010: Traefik BasicAuth singleflight username enumeration via timing oracle](https://junglewise.ai/threats/cve-2026-88010-traefik-basicauth-singleflight-username-enumeration-via-timing) (medium, CVSS 4, published 22 Sep 2026) - [CVE-2026-88012: Traefik readTimeout not enforced on HTTP/3 connections](https://junglewise.ai/threats/cve-2026-88012-traefik-readtimeout-not-enforced-on-http-3-connections) (medium, CVSS 5.3, published 10 Sep 2026) - [CVE-2026-88011: Traefik ForwardAuth identity spoofing via header alias](https://junglewise.ai/threats/cve-2026-88011-traefik-forwardauth-identity-spoofing-via-header-alias) (high, CVSS 8.1, published 10 Sep 2026) - [CVE-2026-88009: Traefik rootless HTTP/1 request-target routing bypass](https://junglewise.ai/threats/cve-2026-88009-traefik-rootless-http-1-request-target-routing-bypass) (high, CVSS 8.2, published 10 Sep 2026) - [CVE-2026-88008: Traefik HTTP request smuggling via unrestricted protocol upgrade](https://junglewise.ai/threats/cve-2026-88008-traefik-http-request-smuggling-via-unrestricted-protocol-upgrade) (critical, CVSS 9.1, published 10 Sep 2026) - [CVE-2026-88007: Traefik HTTP/3 backend NTLM connection reuse](https://junglewise.ai/threats/cve-2026-88007-traefik-http-3-backend-ntlm-connection-reuse) (critical, CVSS 9.1, published 10 Sep 2026) - [CVE-2026-88004: Traefik entrypoint header sanitization bypass via request trailers](https://junglewise.ai/threats/cve-2026-88004-traefik-entrypoint-header-sanitization-bypass-via-request) (high, CVSS 7.4, published 10 Sep 2026) - [CVE-2026-88879: Traefik header name aliasing identity spoofing](https://junglewise.ai/threats/cve-2026-88879-traefik-header-name-aliasing-identity-spoofing) (high, CVSS 8.2, published 10 Sep 2026) - [CVE-2026-88878: Traefik HTTP/3 timeout bypass in respondingTimeouts](https://junglewise.ai/threats/cve-2026-88878-traefik-http-3-timeout-bypass-in-respondingtimeouts) (medium, CVSS 5.3, published 10 Sep 2026) - [CVE-2026-88877: Traefik authentication bypass in ingress-nginx provider](https://junglewise.ai/threats/cve-2026-88877-traefik-authentication-bypass-in-ingress-nginx-provider) (critical, CVSS 9.8, published 10 Sep 2026) - [CVE-2026-85596: Traefik Kubernetes Ingress NGINX authentication bypass via TLS option conflict](https://junglewise.ai/threats/cve-2026-85596-traefik-kubernetes-ingress-nginx-authentication-bypass-via-tls) (critical, CVSS 9.8, published 4 Sep 2026) - [CVE-2026-85595: Traefik digestAuth authentication bypass](https://junglewise.ai/threats/cve-2026-85595-traefik-digestauth-authentication-bypass) (critical, CVSS 9.8, published 4 Sep 2026) - [CVE-2026-85594: Traefik Kubernetes Ingress service middleware crossProviderNamespaces bypass](https://junglewise.ai/threats/cve-2026-85594-traefik-kubernetes-ingress-service-middleware) (critical, CVSS 9.8, published 4 Sep 2026) - [CVE-2026-71325: Traefik namespace isolation bypass in Kubernetes CRD TraefikService](https://junglewise.ai/threats/cve-2026-71325-traefik-namespace-isolation-bypass-in-kubernetes-crd) (medium, CVSS 4, published 6 Aug 2026) - [CVE-2026-71324: Traefik response poisoning via proxied CONNECT in shared connection pool](https://junglewise.ai/threats/cve-2026-71324-traefik-response-poisoning-via-proxied-connect-in-shared) (high, CVSS 4, published 6 Aug 2026) - [CVE-2026-67309: Traefik auth bypass via path traversal in Kubernetes Ingress NGINX provider](https://junglewise.ai/threats/cve-2026-67309-traefik-auth-bypass-via-path-traversal-in-kubernetes-ingress) (high, CVSS 7.5, published 1 Aug 2026) - [Traefik IngressRouteTCP authorization bypass in serversTransport references](https://junglewise.ai/threats/traefik-ingressroutetcp-authorization-bypass-in-serverstransport-f9ba5cbc) (medium, CVSS 5.3, published 22 Jul 2026) - [CVE-2026-65600: Traefik authentication bypass in ReplacePathRegex middleware](https://junglewise.ai/threats/cve-2026-65600-traefik-authentication-bypass-in-replacepathregex-middleware) (critical, CVSS 9.1, published 22 Jul 2026) - [CVE-2026-54765: Traefik incorrect authorization via backendRef filter collision in Kubernetes Gateway API](https://junglewise.ai/threats/cve-2026-54765-traefik-incorrect-authorization-via-backendref-filter-collision) (medium, CVSS 4, published 6 Jul 2026) ## Most severe Traefik vulnerabilities - [CVE-2026-85595: Traefik digestAuth authentication bypass](https://junglewise.ai/threats/cve-2026-85595-traefik-digestauth-authentication-bypass) (critical, CVSS 9.8, published 4 Sep 2026) - [CVE-2026-88877: Traefik authentication bypass in ingress-nginx provider](https://junglewise.ai/threats/cve-2026-88877-traefik-authentication-bypass-in-ingress-nginx-provider) (critical, CVSS 9.8, published 10 Sep 2026) - [CVE-2026-85594: Traefik Kubernetes Ingress service middleware crossProviderNamespaces bypass](https://junglewise.ai/threats/cve-2026-85594-traefik-kubernetes-ingress-service-middleware) (critical, CVSS 9.8, published 4 Sep 2026) - [CVE-2026-85596: Traefik Kubernetes Ingress NGINX authentication bypass via TLS option conflict](https://junglewise.ai/threats/cve-2026-85596-traefik-kubernetes-ingress-nginx-authentication-bypass-via-tls) (critical, CVSS 9.8, published 4 Sep 2026) - [CVE-2026-65600: Traefik authentication bypass in ReplacePathRegex middleware](https://junglewise.ai/threats/cve-2026-65600-traefik-authentication-bypass-in-replacepathregex-middleware) (critical, CVSS 9.1, published 22 Jul 2026) - [CVE-2026-88007: Traefik HTTP/3 backend NTLM connection reuse](https://junglewise.ai/threats/cve-2026-88007-traefik-http-3-backend-ntlm-connection-reuse) (critical, CVSS 9.1, published 10 Sep 2026) - [CVE-2026-88008: Traefik HTTP request smuggling via unrestricted protocol upgrade](https://junglewise.ai/threats/cve-2026-88008-traefik-http-request-smuggling-via-unrestricted-protocol-upgrade) (critical, CVSS 9.1, published 10 Sep 2026) - [CVE-2026-121966: Traefik ForwardAuth connection pool identity leak via NTLM/Negotiate](https://junglewise.ai/threats/cve-2026-121966-traefik-2-x-before-2-11-60-and-3-x-before-3-7-16-sends) (high, CVSS 8.7, published 4 Nov 2026) - [CVE-2026-114642: Traefik NTLM/Kerberos TLS configuration bypass](https://junglewise.ai/threats/cve-2026-114642-traefik-2-11-0-before-2-11-58-and-3-0-0-before-3-7-14-stores-its) (high, CVSS 8.7, published 22 Oct 2026) - [CVE-2026-114639: Traefik authentication bypass in backend connection pool](https://junglewise.ai/threats/cve-2026-114639-traefik-2-11-0-before-2-11-58-and-3-0-0-before-3-7-14-contains) (high, CVSS 8.7, published 22 Oct 2026) ## Vulnerabilities per week 6 vulnerabilities in the last four weeks, up 500% on the four before (1). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 3 | 3 | 0 | | 7 Sep 2026 | 9 | 3 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 4 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Traefik technologies - [Traefik](https://junglewise.ai/threats/technologies/traefik): 40 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Traefik vulnerabilities", https://junglewise.ai/threats/vendors/traefik, 12 November 2026.