Traefik vulnerabilities

In Traefik prior to versions v2.11.51, v3.6.22, and v3.7.6, the BasicAuth, DigestAuth, and ForwardAuth middlewares fail to strip underscore-variant identity headers that backends normalize to dashed forms. An attacker can inject such a header to spoof identity or bypass authorization.

In Traefik prior to 3.7.3, a critical vulnerability in HTTP/3 (QUIC) TLS configuration selection allows unauthenticated clients to bypass router-specific mTLS enforcement. The TLS handshake fails to match wildcard host patterns (e.g., *.example.com) or case variants, falling back to a default TLS config that may not require client certificates.

In Traefik versions 3.7.0 through 3.7.3, a vulnerability in the domain-fronting protection (SNICheck) allows an unauthenticated client to bypass mutual TLS enforced by wildcard router rules. The attacker can complete a TLS handshake under permissive options for a different SNI and then send an HTTP request with a Host header targeting the wildcard-protected backend without presenting a client certificate.

In Traefik prior to versions 2.11.48, 3.6.19, and 3.7.3, a high severity vulnerability exists in the StripPrefix middleware. An unauthenticated attacker can bypass route-level authentication and authorization by using paths containing .. or %2e%2e, which after normalization resolve to protected resources.

A vulnerability in Traefik allows a user with HTTPRoute creation permissions in the Kubernetes Gateway API provider to bypass the providers.rest.insecure=false setting and access the REST provider handler. By accepting TraefikService backends with names ending in @internal, traffic can be routed to rest@internal, enabling unauthorized reconfiguration of routers and services in shared Gateway deployments.

A high severity authentication bypass vulnerability was found in Traefik's ForwardAuth and snippet-based authentication middleware. The issue stems from improper sanitization of header aliases using underscores instead of dashes, allowing an attacker to inject spoofed trust context and bypass authentication without valid credentials.

An authentication bypass vulnerability was found in Traefik's ForwardAuth middleware when trustForwardHeader=false is set and Traefik runs behind a trusted upstream proxy. The issue is fixed in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.

Vulnerability in Traefik (versions 3.0.0 to 3.6.25 and 3.7.10) in the Kubernetes Gateway API provider. Router and service identity construction can cause collisions, allowing overwriting another namespace's backend.

Traefik from 3.6.11 to 3.6.25 and 3.7.10 has a vulnerability in BasicAuth middleware allowing an attacker with valid credentials and hash to authenticate as an unconfigured username.

In Traefik before versions 2.11.54, 3.6.25, and 3.7.10, cross-namespace @kubernetescrd references are not rejected for TraefikService backend references resolved by the service resolver. A tenant confined by RBAC to a single namespace can bind its own router to a TraefikService owned by another namespace and expose or reroute that namespace's backend, defeating the namespace isolation allowCrossNamespace=false is meant to enforce.

Vulnerability in Traefik (before 2.11.53, 3.6.24, and 3.7.9) in the default HTTP reverse proxy. Forwarding CONNECT requests can lead to connection desynchronization, allowing an attacker to smuggle responses to another client.

Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware (generated from the nginx.ingress.kubernetes.io/rewrite-target annotation). When an Ingress path uses a regex that captures attacker-controlled text without requiring a path separator (e.g., path /api(.*) with rewrite target /$1), a crafted request such as /api../admin matches the public router, is rewritten to a dot-segment traversal path (/../admin), and is forwarded without post-replacement normalization validation. A backend that normalizes dot segments resolves the path to a protected endpoint (e.g., /admin) reachable only through a separate router secured with BasicAuth, DigestAuth, or ForwardAuth, resulting in route-level authentication bypass. The issue is fixed in v3.7.8.

Traefik 3.6.0-3.6.22 and 3.7.0-3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references. A low-privileged Kubernetes user in an unauthorized namespace can set serversTransport: foo@file, allowing use of file-provider TCPServersTransport, including privileged mTLS client certificates, SPIFFE identity, or PROXY-protocol settings. Fixed in 3.6.23 and 3.7.7.

Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route author holding a ReferenceGrant for a cross-namespace Service could therefore bind a Traefik Middleware from the backend namespace without a separate grant for that middleware, potentially injecting trusted reverse-proxy identity headers into downstream requests. The issue is fixed in version 3.7.7.

Traefik versions up to 2.11.51, from 3.6.0 to 3.6.22, and from 3.7.0 to 3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. An unauthenticated attacker can send a crafted request that, after processing by the middleware, reaches the backend without path normalization validation, allowing access to protected resources.

Traefik versions 3.7.0 through 3.7.5 have a vulnerability in the Kubernetes Gateway API provider where two accepted HTTPRoutes targeting the same backend Service:port but with different backendRef filters may apply only one route's filter set to all requests reaching that backend. An attacker can impose their filter context on another route's requests, potentially crossing namespace boundaries.

In Traefik prior to versions v2.11.51, v3.6.22, and v3.7.6, the ForwardAuth middleware, even when configured with trustForwardHeader: false, derives the X-Forwarded-Port header from the original incoming request instead of the sanitized forwarded request. An unauthenticated remote attacker can inject an X-Forwarded-Proto: https header over a plain HTTP connection and cause Traefik to forward X-Forwarded-Port: 443 to the authentication service, bypassing port-based authorization checks.

A vulnerability in Traefik before 2.10.5 and 3.0.0-beta4 allows DoS via rapid creation and cancellation of HTTP/2 streams (Rapid Reset technique). The issue originates from the Go standard library's HTTP/2 implementation.

In Traefik versions prior to 2.11.43, 3.6.14, and 3.7.0-rc.2, a high severity authentication bypass vulnerability exists in the StripPrefixRegex middleware when used with ForwardAuth, BasicAuth, or DigestAuth. The issue arises from a mismatch between the decoded URL path and the raw path after stripping, allowing a request with a dot-segment (e.g., /./admin/secret) to reach the backend, which normalizes it to the protected path.

In Traefik prior to versions 2.11.42, 3.6.11, and 3.7.0-ea.3, when `headerField` is configured with a non-canonical HTTP header name (e.g., `x-auth-user` instead of `X-Auth-User`), an authenticated attacker can inject their own canonical version of that header to impersonate any identity to the backend. The backend receives two header entries, with the attacker-injected canonical one being read first, overriding Traefik's non-canonical write.

A vulnerability in Traefik allows injection of routing rules by interpolating unsanitized user input in the Knative provider. Attackers can bypass host restrictions and route traffic to attacker-controlled domains, leading to unauthorized access to victim services in multi-tenant clusters.

A vulnerability in Traefik allows bypassing mutual TLS (mTLS) authentication by sending a fragmented ClientHello packet. When SNI extraction fails due to fragmentation, the TCP router falls back to the default TLS configuration, which does not require client certificates.

In Traefik versions 2.11.9 to 2.11.37 and 3.1.3 to 3.6.8, there is a vulnerability due to incorrect case sensitivity handling in the Connection header. A remote unauthenticated attacker can use lowercase Connection tokens to bypass protection and remove Traefik-managed X-Forwarded headers.

In Traefik prior to versions 2.11.38 and 3.6.9, a vulnerability exists in TLS handshake management on TCP routers. An unauthenticated attacker can send an incomplete TLS record and stop transmission, causing the handshake to stall indefinitely and holding connections open.

A vulnerability in Traefik before version 3.6.8 allows an unauthenticated client to bypass the readTimeout by sending an 8-byte Postgres SSLRequest (STARTTLS) prelude and then stalling, causing connections to remain open indefinitely and leading to a denial of service.