Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: traefik 2.11.58 Clear all filters
TI-2026-79155 CVE-2026-114656 · GHSA-rq4g-2h45-7vgr

Authentication bypass in Traefik lets clients skip mTLS checks

Priority LOW 29

Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00154 Published 2026-10-22 Fixed in 2.11.58, 3.7.13 CWE-436
TI-2026-79154 CVE-2026-114642 · GHSA-x4hj-7xc2-whmq

Traefik lets one service bypass another's TLS certificate checks

Priority LOW 30

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for anot…

CVSS 4.0HIGH 7.0 Network No auth No interaction EPSS 0.00193 Published 2026-10-22 Fixed in 2.11.58, 3.7.14 CWE-295
TI-2026-79153 CVE-2026-114641 · GHSA-q9pf-jh7g-83mc

Race condition in Traefik NTLM and Kerberos authentication

Priority LOW 28

Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round tripper slot is read and written without synchr…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00256 Published 2026-10-22 Fixed in 2.11.58, 3.7.14 CWE-362
TI-2026-79151 CVE-2026-114639 · GHSA-wx2g-x89x-v9j3

Authentication bypass in Traefik via shared Negotiate connection pool

Priority LOW 33

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backen…

CVSS 4.0HIGH 7.0 Network No auth No interaction EPSS 0.00295 Published 2026-10-22 Fixed in 2.11.58, 3.7.14 CWE-287
TI-2026-79147 CVE-2026-114635 · GHSA-m6hw-6pp7-2ffc

Authentication bypass in Traefik SNI check via HTTP/2 scheme

Priority LOW 32

Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil.

CVSS 4.0HIGH 7.0 Network No auth No interaction EPSS 0.00188 Published 2026-10-22 Fixed in 2.11.58, 3.7.14 CWE-288