- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
13 assets you may test, 6 excluded.
Web 1
- https://traefik.io
Products and areas 12
- Access logs, metrics and tracing exporters, and what each writes about a request
- Every middleware shipped in core, in particular ForwardAuth, BasicAuth, DigestAuth, IPAllowList, Headers, StripPrefix, RedirectRegex, ReplacePathRegex, RateLimit, InFlightReq, Buffering and Chain
- HTTP/2 and HTTP/3 handling, connection reuse to backends and the header rewriting that happens on the way through
- Service load balancing, sticky sessions, health checking, mirroring and the weighted and failover services
- The ACME client and every certificate resolver, covering HTTP, TLS-ALPN and DNS challenges and the provider credentials each holds
- The API and the dashboard, plus the entrypoint configuration that decides whether they are reachable
- The entrypoint layer itself, including proxy protocol handling and the trusted IP configuration that decides which forwarded headers are believed
- The HTTP, TCP and UDP routers and the rule matcher behind them, covering host, path, header, query and method matching in both the v2 and v3 syntaxes
- The plugin system, both the Yaegi-interpreted plugins and the WASM path, and the plugin catalogue install flow
- The provider layer in full: Kubernetes Ingress, IngressRoute and Gateway API, Docker and Swarm label discovery, Consul, Nomad, ECS, the file provider and the key-value stores
- The published process asks for a private GitHub Security Advisory on traefik/traefik and states there is no paid programme. It draws no boundary narrower than the Traefik binary itself
- TLS termination, SNI-based routing, certificate resolution, mutual TLS and the client certificate information passed to backends
Out of scope (6)
- A middleware chain or routing rule an operator wrote that is simply more permissive than they intended
- The applications behind the proxy: a defect in the backend is the backend's
- The dashboard or API deliberately exposed on a public entrypoint without authentication, which the documentation warns against
- The Go standard library and other upstream dependencies, unless Traefik's own use of them is what makes the defect reachable
- Third-party plugins from the catalogue that Traefik Labs does not maintain
- Traefik Hub and the commercial proxy products, which are separate offerings
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Report through a private GitHub Security Advisory on traefik/traefik . That is the documented channel and the project publishes fixes as GHSAs with CVEs
-
Do not open a public GitHub issue for a security bug, and do not raise it in the community forum or Discord
-
Give the full dynamic and static configuration that reproduces it, including the provider in use.
-
Name the Traefik major version.
-
Show what sits behind the proxy and what the backend does with the request.
-
Hold detail until the advisory is public.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-119573 | Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cross-namespace check on the auth-tls-secret annotation when a cached client authentication TLS option is reused. Users who can create Ingresses can reference another namespace's CA secret already used by another Ingress, enforcing it on their own routes and learning whether it exi | Low 2.1 | 30 Oct 2026 |
| CVE-2026-119574 | Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1 protocol upgrades. Attackers can repeatedly open and abort upgraded connections such as WebSocket, corrupting the unsynchronized shared bufio.Reader and triggering an unrecovered panic that terminates Traefik. | High 8.2 | 30 Oct 2026 |
| CVE-2026-114637 | Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be handed a pooled keep-alive backend connection where a victim completed an NTLM or Negotiate handshake, letting them read victim data and act | High 7.0 | 22 Oct 2026 |
| CVE-2026-114638 | Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide after dot-to-dash normalization. Attackers holding certificates from another host's CA can access a host requiring its own client CA, while that host's legitimate clients are refused. | High 7.0 | 22 Oct 2026 |
| CVE-2026-114639 | Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on separate frontend connections can be assigned that NTLM/Kerberos-bound socket and perform reads or writes w | High 7.0 | 22 Oct 2026 |
| CVE-2026-114640 | Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on the plaintext HTTP router. When ssl-redirect is disabled alongside auth-tls-pass-certificate-to-upstream, unauthenticated attackers can send Ssl-Client-Verify: SUCCESS with a chosen certificate subject and issuer to impers | High 7.0 | 22 Oct 2026 |
| CVE-2026-114641 | Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote attackers can send concurrent HTTP/2 or HTTP/3 requests over one connection to orphan backend connections, break connection-bound authentication, or crash Traefik | Medium 6.3 | 22 Oct 2026 |
| CVE-2026-114642 | Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backend issuing an NTLM or Negotiate challenge, then reach another service on the same keep-alive connection | High 7.0 | 22 Oct 2026 |
| CVE-2026-114656 | Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router rule with !Host() creates a TLS options conflict that falls back to the default options. | Medium 6.9 | 22 Oct 2026 |
| CVE-2026-114635 | Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client certificates without presenting one. | High 7.0 | 22 Oct 2026 |
| CVE-2026-114636 | Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations. Unauthenticated attackers reaching the HTTP entry point with the Ingress host can access backends protected by auth-type, auth-url, or whitelist-source | High 7.0 | 22 Oct 2026 |
| CVE-2026-112778 | Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service resources in one namespace can set router.middlewares or service.serverstransport annotations to obtain | Medium 6.4 | 19 Oct 2026 |
| CVE-2026-88010 | Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basic_auth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames therefore coalesce on one key while configured usernames perform separate password hashes, creating an unauthenticated timing di | Medium 6.3 | 22 Sep 2026 |
| CVE-2026-88009 | Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evaluates routing, path sanitization, forwardAuth, encodedCharacters, and access logging against a path normalized to / but forwards URL.Opaque verbatim to the backend | High 8.8 | 10 Sep 2026 |
| CVE-2026-88011 | Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User while normalization-prone CGI, WSGI, PHP, and NGINX backends collapse both names. A backend can conseque | Medium 5.3 | 10 Sep 2026 |
| CVE-2026-88012 | Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connection and the HTTP/3 server has no corresponding QUIC stream deadline. An unauthenticated client can use a slow request body, trickling data indefinitely while holding | Medium 5.3 | 10 Sep 2026 |
| CVE-2026-88007 | Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport instead of a transport dedicated to each frontend connection. With HTTP/3 enabled, a backend using connection-bound NTLM or Negotiate authentication, and backend k | Critical 9.1 | 10 Sep 2026 |
| CVE-2026-88008 | Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. If the backend accepts h2c and returns 101 Switching Protocols, Traefik enters a raw tunnel and no longer applies routers, BasicAuth, ForwardAuth, IPAllowList, | High 7.0 | 10 Sep 2026 |
| CVE-2026-88004 | Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but not req.Trailer, allowing an unauthenticated client to submit an aliasing or trusted header name in an HTTP/1.1 chunked trailer or an HTTP/2 trailer. When the retry or buffering middleware r | High 7.0 | 10 Sep 2026 |
| CVE-2026-88877 | Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creates an additional 'sibling' router that matches on the host alone, carries only the RedirectRegex midd | Critical 9.3 | 10 Sep 2026 |
| CVE-2026-88878 | Traefik is an HTTP reverse proxy and load balancer. In versions >= v2.8.2 through <= v2.11.55 and >= v3.0.0 through <= v3.7.11, the entryPoints.<name>.transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying TCP connection, which cannot be applied to a QUIC s | Medium 6.9 | 10 Sep 2026 |
| CVE-2026-88879 | Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so X-Auth-User, X_Auth_User and X.Auth.User are treated as three distinct headers by Traefik, while backends that derive variable names from header names (CGI, WSGI, PHP, NGINX and others) collapse them into a single variable. A clie | Medium 5.3 | 10 Sep 2026 |
| CVE-2026-85594 | Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its Service, and if that middleware injects backend credentials, recover them at a controlled backend. | High 7.0 | 4 Sep 2026 |
| CVE-2026-85595 | Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty secret and arbitrary credentials to bypass authentication on any digestAuth-protected route without a valid username or pas | Critical 9.3 | 4 Sep 2026 |
| CVE-2026-85596 | Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress carrying the nginx.ingress.kubernetes.io/auth-tls-secret annotation was named after the Ingress namespace and name. As a result, two Ingress objects sharing the same host, the same client CA secret, and the same client-authentication mode prod | High 8.2 | 4 Sep 2026 |
| CVE-2026-85597 | Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiting shared TLS resolution across multiple hostnames in a single router rule, causing the strict mTLS req | High 8.2 | 4 Sep 2026 |
| CVE-2026-71326 | Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basic_auth.go deduplicates concurrent password checks with a singleflight key built from the delimiter-free concatenation of password and secret, allowing an attacker who has a valid credential and the stored hash to authenticate as an unconfig | Low 2.1 | 6 Aug 2026 |
| CVE-2026-71327 | Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go builds HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute router and service identities by hyphen-concatenating namespace, route name, Gateway identity, entry point, and ru | High 7.6 | 6 Aug 2026 |
| CVE-2026-71324 | Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/3 CONNECT request and its body to an HTTP/1.1 upstream through a shared net/http.Transport. When the upstream answers the CONNECT with a keep-alive non-2xx response and does not drain the body, Traefik returns the desynchronized b | High 7.0 | 6 Aug 2026 |
| CVE-2026-71325 | Traefik is an open-source edge router that makes publishing services a fun and easy experience. Prior to 2.11.54, 3.6.25, and 3.7.10, cross-namespace @kubernetescrd references are not rejected for TraefikService backend references resolved by the service resolver. A tenant confined by RBAC to a single namespace can therefore bind its own router to a TraefikService owned by another namespace and ex | Medium 4.8 | 6 Aug 2026 |
| CVE-2026-67309 | Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware (generated from the nginx.ingress.kubernetes.io/rewrite-target annotation). When an Ingress path uses a regex that captures attacker-controlled text without requiring a path separator (e.g., path /api(.*) with rewrite target /$1), a crafted request suc | High 7.8 | 1 Aug 2026 |
| CVE-2026-65602 | Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references (the allowlist was only enforced for HTTP serversTransport references). A low-privileged Kubernetes user in a namespace not listed in crossProviderNamespaces can set serversTransport: foo@file on an IngressRouteTCP service, causing Traef | Medium 5.3 | 22 Jul 2026 |
| CVE-2026-65600 | Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex "^/api(.*)", replacement "/$1"), the middleware forwards the replaced path to the backend withou | High 7.8 | 22 Jul 2026 |
| CVE-2026-65601 | Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route author holding a ReferenceGrant for a cross-namespace Service could therefore bind a Traefik Middlewa | Medium 5.3 | 22 Jul 2026 |
| CVE-2026-54763 | Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares strip canonical-cased spoofed identity headers before writing Traefik's own value, but do not account for underscore-variant header names, which many backends normalize identically to dashed forms. An attacker able to reach a protected route can i | High 7.8 | 6 Jul 2026 |
| CVE-2026-54764 | Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's ForwardAuth middleware, even when configured with trustForwardHeader: false, derives the X-Forwarded-Port header sent to the authentication service from the original incoming request instead of the sanitized forwarded request. As a result, an unauthenticated remote attacker can inject an X-Forward | Medium 6.9 | 6 Jul 2026 |
| CVE-2026-54765 | Traefik is an open source HTTP reverse proxy and load balancer. From v3.7.0 prior to v3.7.6, Traefik's Kubernetes Gateway API provider may resolve two accepted HTTPRoutes that target the same backend Service:port but configure different backendRef filters to the same child service and apply only one route's filter set to all requests reaching that backend. In Gateway deployments where backendRef f | Medium 6.3 | 6 Jul 2026 |
| CVE-2026-54761 | Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.21 and 3.7.5, there is a high severity vulnerability in Traefik's Kubernetes Gateway provider affecting the crossProviderNamespaces allowlist. For HTTPRoute rules that declare multiple (WRR) backendRefs, Traefik evaluates the allowlist against the target backendRef.namespace instead of the route's own namespace. As a result, an HTTPR | Medium 6.0 | 23 Jun 2026 |
| CVE-2026-54762 | Traefik is an HTTP reverse proxy and load balancer. From 3.7.0-ea.1 until 3.7.5, there is a medium severity vulnerability in Traefik's Kubernetes Ingress NGINX provider that causes affected routes to fail open. When an Ingress explicitly enables BasicAuth or DigestAuth through the supported nginx.ingress.kubernetes.io/auth-type and auth-secret annotations, but the referenced auth Secret cannot be | Medium 5.9 | 23 Jun 2026 |
| CVE-2026-53622 | Traefik is an HTTP reverse proxy and load balancer. Versions prior to 3.7.3, 3.6.18, and 2.11.51 have a critical vulnerability in Traefik's HTTP/3 (QUIC) TLS configuration selection that allows unauthenticated clients to bypass router-specific mTLS enforcement. When HTTP/3 is enabled on an entrypoint, the TLS handshake selects the applicable TLS configuration through an exact, case-sensitive looku | High 7.8 | 23 Jun 2026 |
| CVE-2026-48020 | Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a high severity vulnerability in Traefik's StripPrefix middleware that allows an unauthenticated attacker to bypass route-level authentication and authorization. When a public router matches on a PathPrefix rule and applies the StripPrefix middleware, a request path containing .. or its percent-encode | High 7.8 | 23 Jun 2026 |
| CVE-2026-48491 | Traefik is an HTTP reverse proxy and load balancer. From 3.7.0 until 3.7.3, there is a high severity vulnerability in Traefik's domain-fronting protection (SNICheck) that allows an unauthenticated client to bypass mutual TLS enforced through wildcard router TLSOptions. When a router uses a wildcard host rule such as Host(*.example.com) with stricter TLS options (for example RequireAndVerifyClientC | High 7.8 | 23 Jun 2026 |
| CVE-2023-54365 | Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-2023-39325, the 'Rapid Reset' technique). A remote attacker can rapidly create and cancel HTTP/2 streams to exhaust server resources and cause service unavailability. | High 8.7 | 23 Jun 2026 |
| CVE-2026-44774 | Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.46, 3.6.17, and 3.7.1, Traefik's Kubernetes Gateway API provider allows a tenant with HTTPRoute creation permissions to expose the REST provider handler, bypassing the providers.rest.insecure=false setting. The Gateway provider accepts any TraefikService backend reference whose name ends with @internal, making it possible to route t | Medium 6.4 | 15 May 2026 |
| CVE-2026-41181 | Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.44, 3.6.15, and 3.7.0-rc.3, there is an information disclosure vulnerability in Traefik's errors (custom error pages) middleware. When the backend returns a response matching the configured status range, the middleware forwards the original request's complete header set, including Authorization, Cookie, and other authentication mate | Medium 6.9 | 15 May 2026 |
| CVE-2026-40912 | Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's StripPrefixRegex middleware when used in combination with ForwardAuth, BasicAuth, or DigestAuth. The middleware matches the regex against the decoded URL path but uses the resulting byte length to slice the percent-encoded | High 7.8 | 30 Apr 2026 |
| CVE-2026-41174 | Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a potential vulnerability in Traefik's Kubernetes CRD provider cross-namespace isolation enforcement. When providers.kubernetesCRD.allowCrossNamespace=false, Traefik correctly rejects direct cross-namespace middleware references from IngressRoute objects, but fails to apply the same rest | Medium 4.8 | 30 Apr 2026 |
| CVE-2026-41263 | Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a timing side-channel vulnerability in Traefik's BasicAuth middleware that allows an attacker to enumerate valid usernames through response-time differences. The variable intended to hold a constant-time fallback secret always resolves to an empty string, causing the constant-time compar | Medium 6.3 | 30 Apr 2026 |
| CVE-2026-35051 | Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is an authentication bypass vulnerability in Traefik's ForwardAuth middleware when trustForwardHeader=false is configured and Traefik is deployed behind a trusted upstream proxy. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2. | High 7.8 | 30 Apr 2026 |
| CVE-2026-39858 | Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's ForwardAuth and snippet-based authentication middleware. Traefik's forwarded-header sanitization logic targets only canonical header names (e.g., X-Forwarded-Proto) and does not strip or normalize alias variants that use un | High 7.8 | 30 Apr 2026 |
| CVE-2026-33433 | Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.42, 3.6.11, and 3.7.0-ea.3, when `headerField` is configured with a non-canonical HTTP header name (e.g., `x-auth-user` instead of `X-Auth-User`), an authenticated attacker can inject their own canonical version of that header to impersonate any identity to the backend. The backend receives two header entries — the attacker | Medium 5.1 | 27 Mar 2026 |
| CVE-2026-32695 | Traefik is an HTTP reverse proxy and load balancer. Prior to versions 3.6.11 and 3.7.0-ea.2, Traefik's Knative provider builds router rules by interpolating user-controlled values into backtick-delimited rule expressions without escaping. In live cluster validation, Knative `rules[].hosts[]` was exploitable for host restriction bypass (for example `tenant.example.com`) || Host(`attacker.com`), pro | Medium 6.3 | 27 Mar 2026 |
| CVE-2026-32595 | Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1 comtain BasicAuth middleware that allows username enumeration via a timing attack. When a submitted username exists, the middleware performs a bcrypt password comparison taking ~166ms. When the username does not exist, the response returns immediately in ~0.6ms. This ~298x tim | Medium 6.3 | 20 Mar 2026 |
| CVE-2026-32305 | Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1 are vulnerable to mTLS bypass through the TLS SNI pre-sniffing logic related to fragmented ClientHello packets. When a TLS ClientHello is fragmented across multiple records, Traefik's SNI extraction may fail with an EOF and return an empty SNI. The TCP router then falls back t | High 7.8 | 20 Mar 2026 |
| CVE-2026-29777 | Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.10, A tenant with write access to an HTTPRoute resource can inject backtick-delimited rule tokens into Traefik's router rule language via unsanitized header or query parameter match values. In shared gateway deployments, this can bypass listener hostname constraints and redirect traffic for victim hostnames to attacker-controlled bac | Medium 6.1 | 11 Mar 2026 |
| CVE-2026-29054 | Traefik is an HTTP reverse proxy and load balancer. From version 2.11.9 to 2.11.37 and from version 3.1.3 to 3.6.8, there is a potential vulnerability in Traefik managing the Connection header with X-Forwarded headers. When Traefik processes HTTP/1.1 requests, the protection put in place to prevent the removal of Traefik-managed X-Forwarded headers (such as X-Real-Ip, X-Forwarded-Host, X-Forwarded | High 7.5 | 5 Mar 2026 |
| CVE-2026-26998 | Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.38 and 3.6.9, there is a potential vulnerability in Traefik managing the ForwardAuth middleware responses. When Traefik is configured to use the ForwardAuth middleware, the response body from the authentication server is read entirely into memory without any size limit. There is no maxResponseBodySize configuration to restr | Medium 4.4 | 5 Mar 2026 |
| CVE-2026-26999 | Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.38 and 3.6.9, there is a potential vulnerability in Traefik managing TLS handshake on TCP routers. When Traefik processes a TLS connection on a TCP router, the read deadline used to bound protocol sniffing is cleared before the TLS handshake is completed. When a TLS handshake read error occurs, the code attempts a second ha | High 7.5 | 5 Mar 2026 |
| CVE-2026-25949 | Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.8, there is a potential vulnerability in Traefik managing STARTTLS requests. An unauthenticated client can bypass Traefik entrypoint respondingTimeouts.readTimeout by sending the 8-byte Postgres SSLRequest (STARTTLS) prelude and then stalling, causing connections to remain open indefinitely, leading to a denial of service. This vulne | High 7.5 | 12 Feb 2026 |
| CVE-2026-22045 | Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.35 and 3.6.7, there is a potential vulnerability in Traefik ACME TLS certificates' automatic generation: the ACME TLS-ALPN fast path can allow unauthenticated clients to tie up go routines and file descriptors indefinitely when the ACME TLS challenge is enabled. A malicious client can open many connections, send a minimal ClientHell | Medium 5.9 | 15 Jan 2026 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 29 Last 12 months 51 Lifetime Auth bypass 35 % Routing/path handling 30 % Request smuggling 20 % Info disclosure 15 % Latest advisories Loading the feed Overview Traefik is the edge router in front of a large share of containerised deployments. It is the default ingress in K3s and the usual reverse proxy in Docker Compose stacks, so it terminates TLS and makes the routing decision for traffic arriving from the internet. A routing or middleware defect there is an authentication bypass for everything behind it, because the proxy is the component enforcing the rule. Traefik Labs states in its own documentation that it does not operate a paid bug bounty program, and its code of conduct rules out demands for compensation. sorona.xyz pays you directly on qualified, reproduced findings. In scope The published process asks for a private GitHub Security Advisory on traefik/traefik and states there is no paid programme. It draws no boundary narrower than the Traefik binary itself The HTTP, TCP and UDP routers and the rule matcher behind them, covering host, path, header, query and method matching in both the v2 and v3 syntaxes Every middleware shipped in core, in particular ForwardAuth, BasicAuth, DigestAuth, IPAllowList, Headers, StripPrefix, RedirectRegex, ReplacePathRegex, RateLimit, InFlightReq, Buffering and Chain The provider layer in full: Kubernetes Ingress, IngressRoute and Gateway API, Docker and Swarm label discovery, Consul, Nomad, ECS, the file provider and the key-value stores TLS termination, SNI-based routing, certificate resolution, mutual TLS and the client certificate information passed to backends The ACME client and every certificate resolver, covering HTTP, TLS-ALPN and DNS challenges and the provider credentials each holds The API and the dashboard, plus the entrypoint configuration that decides whether they are reachable Service load balancing, sticky sessions, health checking, mirroring and the weighted and failover services The plugin system, both the Yaegi-interpreted plugins and the WASM path, and the plugin catalogue install flow HTTP/2 and HTTP/3 handling, connection reuse to backends and the header rewriting that happens on the way through Access logs, metrics and tracing exporters, and what each writes about a request The entrypoint layer itself, including proxy protocol handling and the trusted IP configuration that decides which forwarded headers are believed Out of scope The applications behind the proxy: a defect in the backend is the backend's A middleware chain or routing rule an operator wrote that is simply more permissive than they intended The dashboard or API deliberately exposed on a public entrypoint without authentication, which the documentation warns against Third-party plugins from the catalogue that Traefik Labs does not maintain Traefik Hub and the commercial proxy products, which are separate offerings The Go standard library and other upstream dependencies, unless Traefik's own use of them is what makes the defect reachable Most-valued findings Routing and path normalisation defects where a request reaches a router the rule was never meant to match. On an ingress this is a direct authentication bypass for whatever the intended router was protecting ForwardAuth and the authentication middlewares, particularly any path where a client-supplied header reaches the backend as an authenticated identity, or where the auth call is skipped Request smuggling and desync between Traefik's parser and the backend's, which lets one client's request be attributed to another connection Trusted-header handling, where X-Forwarded-For, X-Real-IP or client certificate headers from the client survive into the backend and forge the caller's identity or address IPAllowList and rate limit evaluation that reads the wrong source address, since both are commonly the only control on an administrative route Kubernetes provider defects where a namespaced IngressRoute, middleware or TLS option reaches a service or secret in another namespace, which crosses the cluster's tenancy boundary ACME and certificate resolver defects that issue, cache or serve a certificate for a host the deployment does not control The API or dashboard becoming reachable through a routing rule rather than through the entrypoint an operator configured The advisory stream is live rather than dormant here, with CVE-2026-54763 the most recent entry the study records Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report through a private GitHub Security Advisory on traefik/traefik . That is the documented channel and the project publishes fixes as GHSAs with CVEs Do not open a public GitHub issue for a security bug, and do not raise it in the community forum or Discord The documentation states directly that Traefik does not operate a paid bug bounty program, and the code of conduct prohibits demands for payment or compensation. There is nothing to negotiate Give the full dynamic and static configuration that reproduces it, including the provider in use. A rule that behaves one way under the file provider can behave differently under the Kubernetes CRDs Name the Traefik major version. The v2 and v3 routing rule syntax and matcher semantics differ enough that a finding on one may not exist on the other Show what sits behind the proxy and what the backend does with the request. A middleware bypass matters because of the application it exposes Disclosure Coordinated through the GitHub advisory flow with the Traefik maintainers, published as a GHSA with a CVE alongside a patched release on the affected branches. Traefik backports security fixes across supported minor versions, so the embargo runs to that coordinated release rather than to a day count you choose. Hold detail until the advisory is public. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability