Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186) in github.com/traefik/traefik

GHSA-46wh-3698-f2cx · GO-2026-4897 · Published 02/04/2026 · updated 07/04/2026

In short

GO-2026-4897 is a not yet rated vulnerability affecting github.com/traefik/traefik, github.com/traefik/traefik/v2, github.com/traefik/traefik/v3.
Fix: update to 2.11.42, 3.6.12, 3.7.0-ea.3 or later.

Package	Affected versions	Patched versions
github.com/traefik/traefik Go	`all versions`	No fix yet
github.com/traefik/traefik/v2 Go	`< 2.11.42`	`2.11.42`
github.com/traefik/traefik/v3 Go	`≥ 3.0.0-beta3, < 3.6.12≥ 3.7.0-ea.1, < 3.7.0-ea.3`	`3.6.123.7.0-ea.3`

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

all versions

No fix yet

< 2.11.42

2.11.42

≥ 3.0.0-beta3, < 3.6.12≥ 3.7.0-ea.1, < 3.7.0-ea.3

3.6.123.7.0-ea.3

More vulnerabilities in github.com/traefik/traefik

See all →