Multiple vulnerabilities in Traefik (August 21, 2026)
Multiple vulnerabilities have been discovered in Traefik. Some of them allow an attacker to cause a security policy bypass.
CSIRTS triage
- What
- Multiple vulnerabilities in Traefik allow security policy bypass.
- Who is affected
- Traefik deployments running affected versions.
- Urgency
- Unknown severity; security policy bypass impact depends on Traefik configuration and should be assessed.
- Action
- Review and apply available Traefik security patches.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Traefik
Get an email when a new Traefik advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1070/
Recent advisories for Traefik
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownCVE-2026-71327: Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.…nvd · 2026-08-06
- unknownCVE-2026-71326: Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3…nvd · 2026-08-06
- unknownCVE-2026-71325: Traefik is an open-source edge router that makes publishing services a fun and easy experience…nvd · 2026-08-06
- unknownCVE-2026-71324: Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and …nvd · 2026-08-06
- highGHSA-x677-9fxg-v5c5: Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField und…ghsa · 2026-08-06
- criticalGHSA-cxjq-mrr5-89rv: Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middlewareghsa · 2026-08-06
More from CERT-FR Avis de sécurité
- unknownMultiple vulnerabilities in Keycloak (August 25, 2026)2026-08-25
- unknownMultiple vulnerabilities in Cisco IOS XE (August 25, 2026)2026-08-25
- unknownMultiple vulnerabilities in LibreNMS (August 24, 2026)2026-08-24
- unknownMultiple vulnerabilities in Metabase (August 24, 2026)2026-08-24
- unknownVulnerability in SPIP (August 21, 2026)2026-08-21