Vulnerabilities in traefik
80 resultsCVE-2026-85595CRITICALTraefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuthEPSS 2.5%CVE-2022-23632HIGHTraefik skips the router TLS configuration when the host header is an FQDNEPSS 1.7%CVE-2024-45410CRITICALHTTP client can remove the X-Forwarded headers in TraefikEPSS 1.5%CVE-2025-54386HIGHTraefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code ExecutionEPSS 1.4%CVE-2022-39271HIGHTraefik HTTP/2 connections management could cause a denial of serviceEPSS 1.4%CVE-2023-47633HIGHUncontrolled Resource Consumption in TraefikEPSS 1.3%CVE-2021-32813MEDIUMDrop Headers via Malicious Connection HeaderEPSS 1.1%CVE-2023-29013HIGHHTTP header parsing could cause a deny of serviceEPSS 1.1%CVE-2026-71324HIGHTraefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive poolEPSS 1.1%CVE-2024-28869HIGHPossible denial of service vulnerability with Content-length header in TraefikEPSS 1.0%CVE-2022-23469LOWAuthorization header displayed in the debug logsEPSS 1.0%CVE-2025-47952LOWTraefik allows path traversal using url encodingEPSS 1.0%CVE-2025-32431HIGHTraefik has a possible vulnerability with the path matchersEPSS 0.9%CVE-2023-47124MEDIUMDenial of service whith ACME HTTPChallenge in TraefikEPSS 0.8%CVE-2026-48020HIGHTraefik StripPrefix Route-Level Auth Bypass via Path NormalizationEPSS 0.8%CVE-2026-25949HIGHTraefik: TCP readTimeout bypass via STARTTLS on PostgresEPSS 0.8%CVE-2026-40912HIGHTraefik: StripPrefixRegex auth bypass via Path/RawPath desyncEPSS 0.8%CVE-2026-67309HIGHTraefik v3.7.0 Path Traversal via RewriteTarget Authentication BypassEPSS 0.7%CVE-2026-88877CRITICALTraefik v3.7.0 Authentication Bypass via from-to-www-redirectEPSS 0.6%CVE-2026-53622HIGHTraefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hostsEPSS 0.6%