CVE-2026-26999

In Traefik prior to versions v2.11.51, v3.6.22, and v3.7.6, the BasicAuth, DigestAuth, and ForwardAuth middlewares fail to strip underscore-variant identity headers that backends normalize to dashed forms. An attacker can inject such a header to spoof identity or bypass authorization.

In Traefik prior to 3.7.3, a critical vulnerability in HTTP/3 (QUIC) TLS configuration selection allows unauthenticated clients to bypass router-specific mTLS enforcement. The TLS handshake fails to match wildcard host patterns (e.g., *.example.com) or case variants, falling back to a default TLS config that may not require client certificates.

In Traefik versions 3.7.0 through 3.7.3, a vulnerability in the domain-fronting protection (SNICheck) allows an unauthenticated client to bypass mutual TLS enforced by wildcard router rules. The attacker can complete a TLS handshake under permissive options for a different SNI and then send an HTTP request with a Host header targeting the wildcard-protected backend without presenting a client certificate.

In Traefik prior to versions 2.11.48, 3.6.19, and 3.7.3, a high severity vulnerability exists in the StripPrefix middleware. An unauthenticated attacker can bypass route-level authentication and authorization by using paths containing .. or %2e%2e, which after normalization resolve to protected resources.

A vulnerability in Traefik allows a user with HTTPRoute creation permissions in the Kubernetes Gateway API provider to bypass the providers.rest.insecure=false setting and access the REST provider handler. By accepting TraefikService backends with names ending in @internal, traffic can be routed to rest@internal, enabling unauthorized reconfiguration of routers and services in shared Gateway deployments.

A high severity authentication bypass vulnerability was found in Traefik's ForwardAuth and snippet-based authentication middleware. The issue stems from improper sanitization of header aliases using underscores instead of dashes, allowing an attacker to inject spoofed trust context and bypass authentication without valid credentials.

An authentication bypass vulnerability was found in Traefik's ForwardAuth middleware when trustForwardHeader=false is set and Traefik runs behind a trusted upstream proxy. The issue is fixed in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.

Vulnerability in Traefik (versions 3.0.0 to 3.6.25 and 3.7.10) in the Kubernetes Gateway API provider. Router and service identity construction can cause collisions, allowing overwriting another namespace's backend.

Traefik from 3.6.11 to 3.6.25 and 3.7.10 has a vulnerability in BasicAuth middleware allowing an attacker with valid credentials and hash to authenticate as an unconfigured username.

In Traefik before versions 2.11.54, 3.6.25, and 3.7.10, cross-namespace @kubernetescrd references are not rejected for TraefikService backend references resolved by the service resolver. A tenant confined by RBAC to a single namespace can bind its own router to a TraefikService owned by another namespace and expose or reroute that namespace's backend, defeating the namespace isolation allowCrossNamespace=false is meant to enforce.