CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 15/01/2026 |
| CVE-2025-66491 | MEDIUM5.9 | Traefik is an HTTP reverse proxy and load balancer. Versions 3.5.0 through 3.6.2 have inverted TLS verification logic in the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. Setting the annotation to "on" (intending to enable backend TLS certificate verification) actually disables verification, allowing man-in- | 09/12/2025 |
| CVE-2025-66490 | MEDIUM6.5 | Traefik is an HTTP reverse proxy and load balancer. For versions prior to 2.11.32 and 2.11.31 through 3.6.2, requests using PathPrefix, Path or PathRegex matchers can bypass path normalization. When Traefik uses path-based routing, requests containing URL-encoded restricted characters (/, \, Null, ;, ?, #) can bypass t | 09/12/2025 |
| CVE-2025-54386 | CRITICAL9.8 | Traefik is an HTTP reverse proxy and load balancer. In versions 2.11.27 and below, 3.0.0 through 3.4.4 and 3.5.0-rc1, a path traversal vulnerability was discovered in WASM Traefik’s plugin installation mechanism. By supplying a maliciously crafted ZIP archive containing file paths with ../ sequences, an attacker can ov | 02/08/2025 |
| CVE-2025-47952 | CRITICAL9.1 | Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. Prior to versions 2.11.25 and 3.4.1, there is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher. When Traefik is configured to route the requests to a backend using a matcher based on the path | 30/05/2025 |
| GO-2025-3627 | Traefik affected by Go HTTP Request Smuggling Vulnerability in github.com/traefik/traefik | 22/04/2025 |
| CVE-2025-32431 | CRITICAL9.1 | Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. In versions prior to 2.11.24, 3.3.6, and 3.4.0-rc2. There is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher. When Traefik is configured to route the requests to a backend using a matcher ba | 21/04/2025 |
| GHSA-5423-jcjm-2gpv | CRITICAL9.1 | Traefik affected by Go HTTP Request Smuggling Vulnerability | 18/04/2025 |
| GHSA-3wqc-mwfx-672p | HIGH7.5 | Traefik affected by Go oauth2/jws Improper Validation of Syntactic Correctness of Input vulnerability | 18/04/2025 |
| GO-2024-3342 | Traefik affected by CVE-2024-53259 in github.com/traefik/traefik | 20/12/2024 |
| GHSA-hxr6-2p24-hf98 | MEDIUM | Traefik affected by CVE-2024-53259 | 17/12/2024 |
| CVE-2024-52003 | MEDIUM6.1 | Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. There is a vulnerability in Traefik that allows the client to provide the X-Forwarded-Prefix header from an untrusted source. This issue has been addressed in versions 2.11.14 and 3.2.1. Users are advised to upgrade. There are no known workarounds | 29/11/2024 |
| CVE-2024-45410 | HIGH7.5 | Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is routed to the application. For a HTTP client, it should not be possible to remove or modify these headers. Since | 19/09/2024 |
| CVE-2024-39321 | HIGH7.5 | Traefik is an HTTP reverse proxy and load balancer. Versions prior to 2.11.6, 3.0.4, and 3.1.0-rc3 have a vulnerability that allows bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes sent with spoofed IP addresses. Versions 2.11.6, 3.0.4, and 3.1.0-rc3 contain a patch for this issue. No kn | 05/07/2024 |
| GO-2024-2941 | ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/traefik/traefik | 28/06/2024 |
| GHSA-rvj4-q8q5-8grf | MEDIUM5.5 | ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability | 20/06/2024 |
| GO-2024-2917 | Traefik has unexpected behavior with IPv4-mapped IPv6 addresses in github.com/traefik/traefik | 14/06/2024 |