Incorrect processing of fragment in the URL leads to Authorization Bypass in Traefik
Priority LOW 30CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates RFC 7230 because in the origin-form the URL should only contain the absolute path and the query. When this is combined with another frontend proxy like Nginx, it can be used to bypass frontend proxy URI-based access control restrictions. This vulnerability has been addressed in versions 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
EPSS 0.00625 50th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed traefik (traefik): 2.10.6, 3.0.0-beta5github.com/traefik/traefik/v2 (Go): 2.10.6+1 more product
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| traefik | traefik | before 2.10.6; 3.0.0-beta1 to before 3.0.0-beta5 | 2.10.6, 3.0.0-beta5 | Patch available | CNA |
| — | github.com/traefik/traefik/v2 (Go) | before 2.10.6 | 2.10.6 | Patch available | GHSA-fvhj-4qfh-q2hm |
| — | github.com/traefik/traefik/v3 (Go) | before 3.0.0-beta5 | 3.0.0-beta5 | Patch available | GHSA-fvhj-4qfh-q2hm |
- traefik Vendortraefik Affected before 2.10.6; 3.0.0-beta1 to before 3.0.0-beta5 Fixed in 2.10.6, 3.0.0-beta5 Patch available CNA
- github.com/traefik/traefik/v2 (Go) Vendor— Affected before 2.10.6 Fixed in 2.10.6 Patch available GHSA-fvhj-4qfh-q2hm
- github.com/traefik/traefik/v3 (Go) Vendor— Affected before 3.0.0-beta5 Fixed in 3.0.0-beta5 Patch available GHSA-fvhj-4qfh-q2hm
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:* | up to 2.10.5 | Vulnerable | traefik |
| cpe:2.3:a:traefik:traefik:3.0.0:beta1:*:*:*:*:*:* | 3.0.0 beta1 | Vulnerable | traefik |
| cpe:2.3:a:traefik:traefik:3.0.0:beta2:*:*:*:*:*:* | 3.0.0 beta2 | Vulnerable | traefik |
| cpe:2.3:a:traefik:traefik:3.0.0:beta3:*:*:*:*:*:* | 3.0.0 beta3 | Vulnerable | traefik |
| cpe:2.3:a:traefik:traefik:3.0.0:beta4:*:*:*:*:*:* | 3.0.0 beta4 | Vulnerable | traefik |
- cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:* Versions up to 2.10.5 Vulnerable ·traefik
- cpe:2.3:a:traefik:traefik:3.0.0:beta1:*:*:*:*:*:* Versions 3.0.0 beta1 Vulnerable ·traefik
- cpe:2.3:a:traefik:traefik:3.0.0:beta2:*:*:*:*:*:* Versions 3.0.0 beta2 Vulnerable ·traefik
- cpe:2.3:a:traefik:traefik:3.0.0:beta3:*:*:*:*:*:* Versions 3.0.0 beta3 Vulnerable ·traefik
- cpe:2.3:a:traefik:traefik:3.0.0:beta4:*:*:*:*:*:* Versions 3.0.0 beta4 Vulnerable ·traefik
Remediation
- Fix · CNA traefik (traefik) Fixed in 2.10.6, 3.0.0-beta5
- Fix · GHSA-fvhj-4qfh-q2hm github.com/traefik/traefik/v2 (Go) Fixed in 2.10.6 Advisory →
- Fix · GHSA-fvhj-4qfh-q2hm github.com/traefik/traefik/v3 (Go) Fixed in 3.0.0-beta5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-47106
- 2026-10-03 Alias added: GHSA-fvhj-4qfh-q2hm
- 2026-10-31 EPSS moved to the 50th–90th percentile
- 2026-11-02 EPSS moved to the below the 50th percentile
- 2026-11-03 EPSS moved to the 50th–90th percentile
References
More Traefik vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2023-25774 Uncontrolled Resource Consumption in Traefik CVSS 3.1HIGH 7.5
- TI-2025-40914 Traefik doesn't Prevent Path Normalization Bypass in Router + Middleware Rules CVSS 4.0MEDIUM 6.9
- TI-2022-07529 Authorization header displayed in the debug logs CVSS 3.1MEDIUM 6.5
- TI-2024-30459 HTTP client can remove the X-Forwarded headers in Traefik CVSS 3.1CRITICAL 9.8
- TI-2026-60261 Traefik v3.7.0 Authentication Bypass via from-to-www-redirect CVSS 4.0CRITICAL 9.3
Sources
- CVE-2023-47106 · CVE Program
- CVE-2023-47106 · NVD
- FIRST EPSS
- GHSA-fvhj-4qfh-q2hm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences