Open redirect in Traefik
Priority LOW 38CWE-601Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601.
Summary
In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, there exists a potential open redirect vulnerability in Traefik's handling of the "X-Forwarded-Prefix" header. The Traefik API dashboard component doesn't validate that the value of the header "X-Forwarded-Prefix" is a site relative path and will redirect to any header provided URI. Successful exploitation of an open redirect can be used to entice victims to disclose sensitive information. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team addressed this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios.
Why it matters now
EPSS 0.08011 94th percentileScored 2026-11-07
Fix Fixed traefik (containous): 1.7.26, 2.2.8github.com/traefik/traefik (Go): 1.7.26+7 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| containous | traefik | before 1.7.26; 2.0.0 to before 2.2.8 | 1.7.26, 2.2.8 | Patch available | CNA |
| — | github.com/traefik/traefik (Go) | 1.5.0-rc5 to before 1.7.26 | 1.7.26 | Patch available | GHSA-6qq8-5wq3-86rp |
| — | github.com/traefik/traefik/v2 (Go) | before 2.3.0-rc6 | 2.3.0-rc6 | Patch available | GHSA-6qq8-5wq3-86rp |
| — | github.com/containous/traefik (Go) | 1.5.0-rc5 to before 1.7.26 | 1.7.26 | Patch available | GHSA-6qq8-5wq3-86rp |
| — | github.com/containous/traefik/v2 (Go) | before 2.2.8 | 2.2.8 | Patch available | GHSA-6qq8-5wq3-86rp |
| — | github.com/traefik/traefik/v2 (Go) | 2.3.0-rc1 to before 2.3.0-rc6 | 2.3.0-rc6 | Patch available | GHSA-6qq8-5wq3-86rp |
| — | github.com/containous/traefik/v2 (Go) | 2.3.0-rc1 to before 2.3.0-rc3 | 2.3.0-rc3 | Patch available | GHSA-6qq8-5wq3-86rp |
| — | github.com/traefik/traefik/api (Go) | 1.5.0-rc5 to before 1.7.26 | 1.7.26 | Patch available | GHSA-6qq8-5wq3-86rp |
| — | github.com/traefik/traefik/v2/pkg/api (Go) | before 2.3.0-rc6 | 2.3.0-rc6 | Patch available | GHSA-6qq8-5wq3-86rp |
| — | github.com/traefik/traefik/v2/pkg/api (Go) | 2.3.0-rc1 to before 2.3.0-rc6 | 2.3.0-rc6 | Patch available | GHSA-6qq8-5wq3-86rp |
| — | github.com/containous/traefik/api (Go) | 1.5.0-rc5 to before 1.7.26 | 1.7.26 | Patch available | GHSA-6qq8-5wq3-86rp |
| — | github.com/containous/traefik/v2/pkg/api (Go) | before 2.2.8 | 2.2.8 | Patch available | GHSA-6qq8-5wq3-86rp |
| — | github.com/containous/traefik/v2/pkg/api (Go) | 2.3.0-rc1 to before 2.3.0-rc3 | 2.3.0-rc3 | Patch available | GHSA-6qq8-5wq3-86rp |
- traefik Vendorcontainous Affected before 1.7.26; 2.0.0 to before 2.2.8 Fixed in 1.7.26, 2.2.8 Patch available CNA
- github.com/traefik/traefik (Go) Vendor— Affected 1.5.0-rc5 to before 1.7.26 Fixed in 1.7.26 Patch available GHSA-6qq8-5wq3-86rp
- github.com/traefik/traefik/v2 (Go) Vendor— Affected before 2.3.0-rc6 Fixed in 2.3.0-rc6 Patch available GHSA-6qq8-5wq3-86rp
- github.com/containous/traefik (Go) Vendor— Affected 1.5.0-rc5 to before 1.7.26 Fixed in 1.7.26 Patch available GHSA-6qq8-5wq3-86rp
- github.com/containous/traefik/v2 (Go) Vendor— Affected before 2.2.8 Fixed in 2.2.8 Patch available GHSA-6qq8-5wq3-86rp
- github.com/traefik/traefik/v2 (Go) Vendor— Affected 2.3.0-rc1 to before 2.3.0-rc6 Fixed in 2.3.0-rc6 Patch available GHSA-6qq8-5wq3-86rp
- github.com/containous/traefik/v2 (Go) Vendor— Affected 2.3.0-rc1 to before 2.3.0-rc3 Fixed in 2.3.0-rc3 Patch available GHSA-6qq8-5wq3-86rp
- github.com/traefik/traefik/api (Go) Vendor— Affected 1.5.0-rc5 to before 1.7.26 Fixed in 1.7.26 Patch available GHSA-6qq8-5wq3-86rp
- github.com/traefik/traefik/v2/pkg/api (Go) Vendor— Affected before 2.3.0-rc6 Fixed in 2.3.0-rc6 Patch available GHSA-6qq8-5wq3-86rp
- github.com/traefik/traefik/v2/pkg/api (Go) Vendor— Affected 2.3.0-rc1 to before 2.3.0-rc6 Fixed in 2.3.0-rc6 Patch available GHSA-6qq8-5wq3-86rp
- github.com/containous/traefik/api (Go) Vendor— Affected 1.5.0-rc5 to before 1.7.26 Fixed in 1.7.26 Patch available GHSA-6qq8-5wq3-86rp
- github.com/containous/traefik/v2/pkg/api (Go) Vendor— Affected before 2.2.8 Fixed in 2.2.8 Patch available GHSA-6qq8-5wq3-86rp
- github.com/containous/traefik/v2/pkg/api (Go) Vendor— Affected 2.3.0-rc1 to before 2.3.0-rc3 Fixed in 2.3.0-rc3 Patch available GHSA-6qq8-5wq3-86rp
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:* | before 1.7.26; 2.2.0 to before 2.2.8 | Vulnerable | traefik |
| cpe:2.3:a:traefik:traefik:2.3.0:-:*:*:*:*:*:* | 2.3.0 | Vulnerable | traefik |
| cpe:2.3:a:traefik:traefik:2.3.0:rc1:*:*:*:*:*:* | 2.3.0 rc1 | Vulnerable | traefik |
| cpe:2.3:a:traefik:traefik:2.3.0:rc2:*:*:*:*:*:* | 2.3.0 rc2 | Vulnerable | traefik |
- cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:* Versions before 1.7.26; 2.2.0 to before 2.2.8 Vulnerable ·traefik
- cpe:2.3:a:traefik:traefik:2.3.0:-:*:*:*:*:*:* Versions 2.3.0 Vulnerable ·traefik
- cpe:2.3:a:traefik:traefik:2.3.0:rc1:*:*:*:*:*:* Versions 2.3.0 rc1 Vulnerable ·traefik
- cpe:2.3:a:traefik:traefik:2.3.0:rc2:*:*:*:*:*:* Versions 2.3.0 rc2 Vulnerable ·traefik
Remediation
- Fix · CNA traefik (containous) Fixed in 1.7.26, 2.2.8
- Fix · GHSA-6qq8-5wq3-86rp github.com/traefik/traefik (Go) Fixed in 1.7.26 Advisory →
- Fix · GHSA-6qq8-5wq3-86rp github.com/traefik/traefik/v2 (Go) Fixed in 2.3.0-rc6 Advisory →
- Fix · GHSA-6qq8-5wq3-86rp github.com/containous/traefik (Go) Fixed in 1.7.26 Advisory →
- Fix · GHSA-6qq8-5wq3-86rp github.com/containous/traefik/v2 (Go) Fixed in 2.2.8 Advisory →
- Fix · GHSA-6qq8-5wq3-86rp github.com/traefik/traefik/v2 (Go) Fixed in 2.3.0-rc6 Advisory →
- Fix · GHSA-6qq8-5wq3-86rp github.com/containous/traefik/v2 (Go) Fixed in 2.3.0-rc3 Advisory →
- Fix · GHSA-6qq8-5wq3-86rp github.com/traefik/traefik/api (Go) Fixed in 1.7.26 Advisory →
- Fix · GHSA-6qq8-5wq3-86rp github.com/traefik/traefik/v2/pkg/api (Go) Fixed in 2.3.0-rc6 Advisory →
- Fix · GHSA-6qq8-5wq3-86rp github.com/traefik/traefik/v2/pkg/api (Go) Fixed in 2.3.0-rc6 Advisory →
- Fix · GHSA-6qq8-5wq3-86rp github.com/containous/traefik/api (Go) Fixed in 1.7.26 Advisory →
- Fix · GHSA-6qq8-5wq3-86rp github.com/containous/traefik/v2/pkg/api (Go) Fixed in 2.2.8 Advisory →
- Fix · GHSA-6qq8-5wq3-86rp github.com/containous/traefik/v2/pkg/api (Go) Fixed in 2.3.0-rc3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-15129
- 2026-10-03 Alias added: GHSA-6qq8-5wq3-86rp
References
Patch 2
Advisory 5
- https://github.com/containous/traefik/security/advisories/GHSA-6qq8-5wq3-86rp
- https://github.com/containous/traefik/releases/tag/v1.7.26
- https://github.com/containous/traefik/releases/tag/v2.2.8
- https://github.com/containous/traefik/releases/tag/v2.3.0-rc3
- https://nvd.nist.gov/vuln/detail/CVE-2020-15129
More containous vulnerabilities
- TI-2021-08868 Traefik before 2.4.5 allows the loading of IFRAME elements from other domains. CVSS 3.1MEDIUM 5.3
Sources
- CVE-2020-15129 · CVE Program
- CVE-2020-15129 · NVD
- FIRST EPSS
- GHSA-6qq8-5wq3-86rp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences