Read the docs
TI-2019-09294 Aliases CVE-2019-12452GHSA-r3fq-cmmw-cpmm

types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used…

Priority LOW 38CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-522.

Summary

types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without sufficient access control (which is contrary to the API documentation), allows remote authenticated users to discover password hashes by reading the Basic HTTP Authentication or Digest HTTP Authentication section, or discover a key by reading the ClientTLS section. These can be found in the JSON response to a /api request.

Why it matters now

EPSS 0.02543 85th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix Fixed github.com/traefik/traefik (Go): 1.7.12

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—github.com/traefik/traefik (Go)1.7.0 to before 1.7.121.7.12Patch availableGHSA-r3fq-cmmw-cpmm
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/traefik/traefik (Go) Vendor— Affected 1.7.0 to before 1.7.12 Fixed in 1.7.12 Patch available GHSA-r3fq-cmmw-cpmm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*1.7.0 – 1.7.11Vulnerabletraefik
  • cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:* Versions 1.7.0 – 1.7.11 Vulnerable ·traefik

Remediation

  • Fix · GHSA-r3fq-cmmw-cpmm github.com/traefik/traefik (Go) Fixed in 1.7.12 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-12452
  2. 2026-10-03 Alias added: GHSA-r3fq-cmmw-cpmm

References

Exploit 3

Advisory 1

Other 2

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2023-25774 Uncontrolled Resource Consumption in Traefik CVSS 3.1HIGH 7.5
  • TI-2025-40914 Traefik doesn't Prevent Path Normalization Bypass in Router + Middleware Rules CVSS 4.0MEDIUM 6.9
  • TI-2022-07529 Authorization header displayed in the debug logs CVSS 3.1MEDIUM 6.5
  • TI-2024-30459 HTTP client can remove the X-Forwarded headers in Traefik CVSS 3.1CRITICAL 9.8
  • TI-2026-60261 Traefik v3.7.0 Authentication Bypass via from-to-www-redirect CVSS 4.0CRITICAL 9.3
See all 83 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences