Traefik has 67 CVEs on record between 2021 and 2026. Cadence is steady at roughly 24 per quarter. The busiest recent month was September 2026 with 14. The median CVSS is 7.5 (high), with 8 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-863 (8) and CWE-287 (6). Most affected products: traefik (38), github.com/traefik/traefik/v2 (15), github.com/traefik/traefik/v3 (8).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 24 prev 18
Products
- traefik 38
- github.com/traefik/traefik/v2 15
- github.com/traefik/traefik/v3 8
- github.com/traefik/traefik 6
Worst active — by depth score
CVE-2026-88877Critical· 9.8Traefik is a HTTP reverse proxy and load balancer66CVE-2026-85595Critical· 9.8Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection66CVE-2026-88008Critical· 9.1Traefik is an open source HTTP reverse proxy and load balancer62CVE-2026-88009High· 8.2Traefik is an open source HTTP reverse proxy and load balancer57CVE-2026-85596Critical· 9.8Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider54
Traefik vulnerabilities
CVEs affecting Traefik, newest first. Open any entry for full detail, references, and exploit status.
67 CVEsRSS
CVE-2023-47124Medium· 5.9Traefik vulnerable to potential DDoS via ACME HTTPChallenge
Traefik vulnerable to potential DDoS via ACME HTTPChallenge
CVE-2023-47633High· 7.5Traefik docker container using 100% CPU
Traefik docker container using 100% CPU
CVE-2023-29013High· 7.5Traefik HTTP header parsing could cause a denial of service
Traefik HTTP header parsing could cause a denial of service
CVE-2022-23469Low· 3.5Traefik may display authorization header in the debug logs
Traefik may display authorization header in the debug logs
CVE-2022-46153Medium· 6.5Traefik routes exposed with an empty TLSOption
Traefik routes exposed with an empty TLSOption
CVE-2020-15129Medium· 6.1PoCTraefik vulnerable to Open Redirect via handling of X-Forwarded-Prefix header
Traefik vulnerable to Open Redirect via handling of X-Forwarded-Prefix header
CVE-2021-32813Medium· 4.8Header dropping in traefik
Header dropping in traefik