T
Vendor security profile
traefik
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs39
Critical8
CISA KEV0
Public exploit14
Patch rate%97
Avg. CVSS7.4
12-month vulnerability rate
0
0
0
1
5
3
1
4
6
5
14
0
CVE KEV
CVE severity distribution
39toplam CVE
Critical8 (21%)
High19 (49%)
Medium11 (28%)
Low1 (3%)
Patch and exploitation view
%97
Verified patch
%0
CISA KEV
%36
Public exploit
38Patch available
0Partial
0Workaround
0Vendor: no patch
1Unknown
Latest vulnerabilities
6.3
CVE-2026-88010
Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle
T
Patch status unknownEPSS %1
5.3
CVE-2026-88012
Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded
T
Patch verifiedEPSS %1
5.3
CVE-2026-88011
Traefik: ForwardAuth identity spoofing via dot-form header alias
T
Patch verifiedEPSS %0
8.8
CVE-2026-88009
Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
T
Patch verifiedEPSS %0
7.0
CVE-2026-88008
Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization
T
Patch verifiedEPSS %0
9.1
CVE-2026-88007
Traefik HTTP/3 Backend NTLM Connection Reuse
T
Patch verifiedEPSS %1
7.0
CVE-2026-88004
Traefik entrypoint header-name sanitization bypassed via request trailers
T
Patch verifiedEPSS %0
5.3
CVE-2026-88879
Traefik before v2.11.56 Identity Spoofing via Header Alias
T
Patch verifiedEPSS %0
6.9
CVE-2026-88878
Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass
T
Patch verifiedEPSS %0
9.3
CVE-2026-88877
Traefik v3.7.0 Authentication Bypass via from-to-www-redirect
T
Patch verifiedEPSS %1