CVE Tools
Track your stack

Traefik

35 CVEs tracked since 2026. Since Mar 2026, none of them reached CISA KEV.

Traefik CVEs per month

Mar 2026 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Traefik CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2026-0380
2026-046 or fewer
2026-057 or fewer
2026-067 or fewer
2026-077 or fewer
2026-088 or fewer
2026-09140
2026-10130
2026-113 or fewer

Products

The products that kept showing up in Traefik's monthly top three, with their CVEs summed over those months.

  1. Traefik353 months

Latest CVEs

The 15 most recently published vulnerabilities affecting Traefik.

  1. CVE-2026-121966Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak8.7
  2. CVE-2026-119574Traefik 3.2.0 before 3.7.15 FastProxy Data Race Denial of Service5.9
  3. CVE-2026-119573Traefik 3.7.11 before 3.7.15 Cross-Namespace Authorization Bypass via auth-tls-secret4.4
  4. CVE-2026-119572Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider8.7
  5. CVE-2026-114656Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher7.5
  6. CVE-2026-114642Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper8.7
  7. CVE-2026-114641Traefik before 2.11.58 and 3.7.14 Race Condition in NTLM/Kerberos Round Tripper3.7
  8. CVE-2026-114639Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool8.7
  9. CVE-2026-114640Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router8.7
  10. CVE-2026-114638Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision8.7
  11. CVE-2026-114637Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leak8.7
  12. CVE-2026-114636Traefik v3.7.13 Authentication Bypass via ssl-passthrough Ingress HTTP Router8.7
  13. CVE-2026-114635Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme8.7
  14. CVE-2026-112778Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations8.8
  15. CVE-2026-88010Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle5.3

The record

Peak rank
#118 in Sep 2026
Busiest month shown
Sep 2026, 14 CVEs
Months with a KEV entry
0 since Mar 2026
Monthly snapshots
3 since 2026
Traefik's full record, month by month