Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Traefik Labs bug bounty programs

traefik.io Updated

Traefik Labs runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
13
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Traefik Labs runs.

  • Traefik

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

13 targets. 6 excluded.

  • https://traefik.io

    Web

  • Access logs, metrics and tracing exporters, and what each writes about a request

    Products and areas

  • Every middleware shipped in core, in particular ForwardAuth, BasicAuth, DigestAuth, IPAllowList, Headers, StripPrefix, RedirectRegex, ReplacePathRegex, RateLimit, InFlightReq, Buffering and Chain

    Products and areas

  • HTTP/2 and HTTP/3 handling, connection reuse to backends and the header rewriting that happens on the way through

    Products and areas

  • Service load balancing, sticky sessions, health checking, mirroring and the weighted and failover services

    Products and areas

  • The ACME client and every certificate resolver, covering HTTP, TLS-ALPN and DNS challenges and the provider credentials each holds

    Products and areas

  • The API and the dashboard, plus the entrypoint configuration that decides whether they are reachable

    Products and areas

  • The entrypoint layer itself, including proxy protocol handling and the trusted IP configuration that decides which forwarded headers are believed

    Products and areas

  • The HTTP, TCP and UDP routers and the rule matcher behind them, covering host, path, header, query and method matching in both the v2 and v3 syntaxes

    Products and areas

  • The plugin system, both the Yaegi-interpreted plugins and the WASM path, and the plugin catalogue install flow

    Products and areas

  • The provider layer in full: Kubernetes Ingress, IngressRoute and Gateway API, Docker and Swarm label discovery, Consul, Nomad, ECS, the file provider and the key-value stores

    Products and areas

  • The published process asks for a private GitHub Security Advisory on traefik/traefik and states there is no paid programme. It draws no boundary narrower than the Traefik binary itself

    Products and areas

  • TLS termination, SNI-based routing, certificate resolution, mutual TLS and the client certificate information passed to backends

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • A middleware chain or routing rule an operator wrote that is simply more permissive than they intended

  • The applications behind the proxy: a defect in the backend is the backend's

  • The dashboard or API deliberately exposed on a public entrypoint without authentication, which the documentation warns against

  • The Go standard library and other upstream dependencies, unless Traefik's own use of them is what makes the defect reachable

  • Third-party plugins from the catalogue that Traefik Labs does not maintain

  • Traefik Hub and the commercial proxy products, which are separate offerings

Recent changes

Reward and scope changes across every Traefik Labs program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Traefik Labs products, from the NVD.

Search NVD
  • CVE-2026-119573 Low

    Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cross-namespace check on the auth-tls-secret annotation when a cached client authentication TLS option is reused. Users who can create Ingresses can reference another namespace's CA secret already used by another Ingress, enforcing it on their own routes and learning whether it exi

  • CVE-2026-119574 High

    Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1 protocol upgrades. Attackers can repeatedly open and abort upgraded connections such as WebSocket, corrupting the unsynchronized shared bufio.Reader and triggering an unrecovered panic that terminates Traefik.

  • CVE-2026-114637 High

    Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be handed a pooled keep-alive backend connection where a victim completed an NTLM or Negotiate handshake, letting them read victim data and act

  • CVE-2026-114638 High

    Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide after dot-to-dash normalization. Attackers holding certificates from another host's CA can access a host requiring its own client CA, while that host's legitimate clients are refused.

  • CVE-2026-114639 High

    Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on separate frontend connections can be assigned that NTLM/Kerberos-bound socket and perform reads or writes w

  • CVE-2026-114640 High

    Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on the plaintext HTTP router. When ssl-redirect is disabled alongside auth-tls-pass-certificate-to-upstream, unauthenticated attackers can send Ssl-Client-Verify: SUCCESS with a chosen certificate subject and issuer to impers

  • CVE-2026-114641 Medium

    Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote attackers can send concurrent HTTP/2 or HTTP/3 requests over one connection to orphan backend connections, break connection-bound authentication, or crash Traefik

  • CVE-2026-114642 High

    Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backend issuing an NTLM or Negotiate challenge, then reach another service on the same keep-alive connection

About this page

This page gathers every public program listed under traefik.io: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.