Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186) in github.com/traefik/traefik

Description

References

• traefik/traefik security advisory · ADVISORY
• GitHub Advisory GHSA-p77j-4mvh-x3m3 · WEB
• traefik/traefik · WEB
• traefik/traefik release v2.11.42 · WEB
• traefik/traefik release v3.6.12 · WEB
• traefik/traefik release v3.7.0-ea.3 · WEB

Más vulnerabilidades de github.com/traefik/traefik

• CVE-2026-88010MEDIO 5.3Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basic_auth.g…
• CVE-2026-88012MEDIO 5.3Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPo…
• CVE-2026-88011ALTO 8.1Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form he…
• CVE-2026-88009ALTO 8.2Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request targ…
• CVE-2026-88008CRÍTICO 9.1Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Co…