Traefik Missing Authentication

ALTO 7.5CVE-2018-15598 · GHSA-2cjc-rgmp-x649 · GO-2023-1950 · Published 21/08/2018 · updated 17/06/2026

Em resumo

CVE-2018-15598 é uma vulnerabilidade ALTO (CVSS 7.5) que afeta github.com/traefik/traefik, traefik (traefik).
Chance de exploração nos próximos 30 dias (EPSS): 2.9%, maior que 86.8% das vulnerabilidades.
Correção: atualize para 1.6.6 ou posterior.

Package	Affected versions	Patched versions
github.com/traefik/traefik Go	`≥ 1.6.0, < 1.6.6`	`1.6.6`
traefik traefik	`≥ 1.6.0, < 1.6.6`	`1.6.6`

Description

Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable.

NVD description

Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable.

References

nvd.nist.gov/vuln/detail/CVE-2018-15598 · ADVISORY
containous/traefik#3790 · WEB
containous/traefik commit 113250c · WEB
containous/traefik commit 368bd17 · WEB
containous/traefik · PACKAGE
containous/traefik release v1.6.6 · WEB
containous/traefik#3790 · Third Party Advisory
containous/traefik#3790 · Third Party Advisory
GitHub Advisory GHSA-2cjc-rgmp-x649 · ADVISORY

Mais vulnerabilidades de github.com/traefik/traefik

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/traefik/traefik

≥ 1.6.0, < 1.6.6

1.6.6

traefik

≥ 1.6.0, < 1.6.6

1.6.6

Description

Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable.

NVD description

Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable.

Mais vulnerabilidades de github.com/traefik/traefik

Ver tudo →