Traefik
Web · products/traefik.yaml · RSS
Latest 3.7.16 Oct 20, 2026
Latest per track
| Track | Latest | Released |
|---|---|---|
| 3 | 3.7.16 | Oct 20, 2026 |
| 2 | 2.11.60 | Oct 20, 2026 |
Lifecycle
| Branch | Latest | Released | End of life |
|---|---|---|---|
| 3.7 | 3.7.16 | May 5, 2026 | — · maintained |
| 3.6 | 3.6.25 | Nov 7, 2025 | Aug 16, 2026 · ended |
| 3.5 | 3.5.6 | Jul 23, 2025 | Nov 7, 2025 · ended |
| 3.4 | 3.4.5 | May 5, 2025 | Jul 23, 2025 · ended |
| 3.3 | 3.3.7 | Jan 6, 2025 | May 5, 2025 · ended |
| 3.2 | 3.2.5 | Oct 28, 2024 | Jan 6, 2025 · ended |
| 3.1 | 3.1.7 | Jul 15, 2024 | Oct 28, 2024 · ended |
| 3.0 | 3.0.4 | Apr 29, 2024 | Jul 15, 2024 · ended |
| 2.11 | 2.11.60 | Feb 12, 2024 | Sep 7, 2026 · ended |
| 2.10 | 2.10.7 | Apr 24, 2023 | Feb 12, 2024 · ended |
| 2.9 | 2.9.10 | Oct 3, 2022 | Apr 24, 2023 · ended |
| 2.8 | 2.8.8 | Jun 29, 2022 | Oct 3, 2022 · ended |
| 2.7 | 2.7.3 | May 24, 2022 | Jun 29, 2022 · ended |
| 2.6 | 2.6.7 | Jan 24, 2022 | May 24, 2022 · ended |
| 2.5 | 2.5.7 | Aug 17, 2021 | Jan 24, 2022 · ended |
| 2.4 | 2.4.14 | Jan 19, 2021 | Aug 17, 2021 · ended |
| 2.3 | 2.3.7 | Sep 23, 2020 | Jan 19, 2021 · ended |
| 2.2 | 2.2.11 | Mar 25, 2020 | Sep 23, 2020 · ended |
| 2.1 | 2.1.9 | Dec 11, 2019 | Mar 25, 2020 · ended |
| 2.0 | 2.0.7 | Sep 16, 2019 | Dec 11, 2019 · ended |
| 1.7 | 1.7.34 | Sep 24, 2018 | Dec 31, 2021 · ended |
Recent releases
security[security] Fix typo in the Request Path page ( @SethFalco)
breakingRemove redundant period in README ( @mxmrnn)
security[security] Document the coordinated disclosure embargo for security reports ( @emilevauge)
securityAdvisory GHSA-qqjf-53cj-pwvv
securityAdvisory GHSA-f52w-8j3h-j724
securityAdvisory GHSA-v67p-phpq-fc8x
securityAdvisory GHSA-cjr6-pf59-jq29
securityAdvisory GHSA-7ghq-v6jf-g56c
securityAdvisory GHSA-rf44-j88r-hh8c
securityAdvisory GHSA-5w68-77r2-r64c
securityAdvisory GHSA-g55h-rg46-x9c5
securityAdvisory GHSA-j994-9gqj-9hwq
securityAdvisory GHSA-fgjj-px3w-67xx
securityAdvisory GHSA-62fc-8686-hfmq
securityAdvisory GHSA-6765-c87h-8mrf
securityAdvisory GHSA-3ccp-42pg-hgv6
securityAdvisory GHSA-8rxv-jg7p-wvg3
securityAdvisory GHSA-cxjq-mrr5-89rv
securityAdvisory GHSA-42cj-m3vj-89wv
securityAdvisory GHSA-qq9q-x9w4-chhj
securityCVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5)
securityCVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m)
securityCVE-2026-54765 (Advisory GHSA-6p8f-p8j2-rqmv)
securityCVE-2026-54761 (Advisory GHSA-3g6v-2r68-prfc)
securityCVE-2026-54762 (Advisory GHSA-4mr2-fg2p-w63c)
securityCVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2)
securityCVE-2026-48491 (Advisory GHSA-5r4w-85f3-pw66)
securityCVE-2026-53622 (Advisory GHSA-9cr8-q42q-g8m7)
securityCVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc)
Security advisories
7.0 GHSA-hrpp-p4fc-wwf8 ForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity across clients
2.1 GHSA-28hp-c82p-8vqj Kubernetes Ingress NGINX provider: a TLS-option cache hit skips the cross-namespace authorization check, letting an Ingress use another namespace's CA secret
8.2 GHSA-ww7c-q3mv-xx22 Data race on the shared bufio.Reader after an HTTP/1 upgrade in FastProxy panics the whole process
7.0 GHSA-p8wx-ph99-xgcr ingress-nginx provider: mTLS (auth-tls-secret) silently disabled for a host when another Ingress on the same host has no matching auth-tls annotation
6.3 GHSA-mhjw-hmjv-p99x Unsynchronized write to the per-connection sticky round tripper shared by concurrent HTTP/2 streams
6.9 GHSA-2272-4vv8-65ww Negated Host matcher causes a TLS option conflict that disables client-certificate authentication on the excluded host
7.0 GHSA-rv2h-qh7j-xrjw Ingress-NGINX provider: colliding auth-tls-secret names merge two client CAs into one TLS option, so a host is gated by another host's CA
7.0 GHSA-qvj7-gq9c-hp7q Kubernetes Ingress NGINX provider: ssl-passthrough sibling HTTP router serves the auth-protected backend without auth
7.0 GHSA-mwrr-6hp4-pxr6 Ingress-NGINX provider forwards forged Ssl-Client-* identity headers on its HTTP route
7.0 GHSA-53qr-784g-cj35 FastProxy backend connection pool leaks connection-bound NTLM/Negotiate identity to unauthenticated clients
7.0 GHSA-cw35-4q88-3rmp Connection-scoped NTLM/Kerberos sticky round tripper is not keyed by service, applying one service TLS client config to another
7.0 GHSA-qm9f-w54v-q2qh Preauthenticated Negotiate contaminates Traefik's globally shared backend connection pool
6.4 GHSA-rh7m-2m44-x32f Traefik: Kubernetes Ingress and Service annotations allow cross-namespace references to Middlewares, ServersTransports, and TLSOptions
6.3 CVE-2026-88010 BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle
7.0 CVE-2026-88008 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization in github.com/traefik/traefik/v3
8.8 CVE-2026-88009 Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
high GHSA-cjr6-pf59-jq29 ingress-nginx from-to-www-redirect sibling router serves the auth-protected backend without auth