Traefik 2.11.25 → 2.11.49
22 releases · 1 breaking change · 23 security fixes · 6 advisories fixed
23security1breaking0deprecated0feature61fix
Vulnerabilities fixed by this upgrade
- 6.4 GHSA-rh7m-2m44-x32f Traefik: Kubernetes Ingress and Service annotations allow cross-namespace references to Middlewares, ServersTransports, and TLSOptions
- 7.8 CVE-2026-53622 HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts
- 7.8 CVE-2026-48020 Traefik StripPrefix Route-Level Auth Bypass via Path Normalization
- 6.4 CVE-2026-44774 Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false
- 6.9 CVE-2026-41181 Errors middleware forwards Authorization and Cookie headers to separate error page service
- 7.5 CVE-2026-29054 Case-Sensitive Bypass in Connection Header Allows Removal of X-Forwarded Headers
Breaking changes
- breaking Remove extra dots in migration guide ( by rtribotte) in 2.11.36
Security changes
- security CVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2) in 2.11.48
- security CVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc) in 2.11.46
- security Advisory GHSA-rh7m-2m44-x32f in 2.11.46
- security CVE-2026-41181 (Advisory GHSA-p6hg-qh38-555r) in 2.11.44
- security CVE-2026-40912 (Advisory GHSA-6jwx-7vp4-9847) in 2.11.43
- security CVE-2026-39858 (Advisory GHSA-5m6w-wvh7-57vm) in 2.11.43
- security CVE-2026-35051 (Advisory GHSA-6384-m2mw-rf54) in 2.11.43
- security CVE-2026-41263 (Advisory GHSA-6x2q-h3cr-8j2h) in 2.11.43
- security CVE-2026-41174 (Advisory GHSA-xhjw-95fp-8vgq) in 2.11.43
- security CVE-2026-33433 (Advisory GHSA-qr99-7898-vr7c) in 2.11.42
- security CVE-2026-33186 (Advisory GHSA-46wh-3698-f2cx) in 2.11.42
- security CVE-2026-32595 (Advisory GHSA-g3hg-j4jv-cwfr) in 2.11.41
- security CVE-2026-32305 (Advisory GHSA-wvvq-wgcr-9q48) in 2.11.41
- security CVE-2026-27141 (Advisory GHSA-4hjq-9h5c-252j) in 2.11.40
- security CVE-2026-26998 (Advisory GHSA-fw45-f5q2-2p4x) in 2.11.38
- security CVE-2026-26999 (Advisory GHSA-xw98-5q62-jx94) in 2.11.38
- security CVE-2026-29054 (Advisory GHSA-92mv-8f8w-wq52) in 2.11.38
- security CVE-2025-68121 (Advisory GHSA-gv8r-9rw9-9697) in 2.11.37
- security warning: Breaking change :warning: As explained in the comment left on the CVE-2025-66490 fix, this new hotfix version makes the behavior opt-in. As a result, this release is breaking compared to the previous hotfix versions since v2.11.32, but it restores by default the behavior that existed… in 2.11.35
- security CVE-2026-22045 (Advisory GHSA-cwjm-3f7h-9hwqj) in 2.11.35
- security CVE-2025-66490 (Advisory GHSA-gm3x-23wp-hc2c): Breaking Change please read the migration guide. in 2.11.32
- security Update SECURITY.md to streamline information ( by emilevauge) in 2.11.32
- security Update SECURITY.md ( by cwayne18) in 2.11.32
Every release in between
fix[http3] Bump github.com/quic-go/quic-go to v0.59.1 ( @rtribotte)
fix[webui] Bump axios to v1.17.0 ( @gndz07)
fix[tls] Fix snicheck with keepalive ( @juliens)
securityCVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2)
fix[tls] Compute resolved tlsOptions after applying models ( @rtribotte)
fix[middleware, authentication] Add error on basic auth build if users is empty ( @rtribotte)
fix[k8s/ingress] Avoid ingress path matcher injection and backport 11d251415 ( @rtribotte)
fix[server] Move snicheck to ctx instead of simulated routing ( @juliens)
fix[middleware] Reject requests with different paths after StripPrefix and StripPrefixRegex normalisation ( @rtribotte)
fix[server] Bump golang.org/x/net to v0.55.0 ( @kevinpollet)
fix[server] Bump golang.org/x/crypto to v0.52.0 ( @rtribotte)
securityCVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc)
securityAdvisory GHSA-rh7m-2m44-x32f
fix[k8s/ingress, k8s/crd, k8s/gatewayapi] Add CrossProviderNamespaces option ( @rtribotte)
fix[k8s/crd] Fix cross-provider ref check for Kubernetes CRD provider ( @rtribotte)
fix[k8s/crd] Remove cross-provider sanitization for Kubernetes service loading ( @rtribotte)
fix[docker, ecs] Migrate to github.com/moby/moby modules ( @mmatur)
securityCVE-2026-41181 (Advisory GHSA-p6hg-qh38-555r)
fix[middleware] Add errorRequestHeaders option to Errors middleware ( @gndz07)
fix[acme] Bump github.com/go-acme/lego to v4.35.2 ( @mmatur)
otherMake FLAGS Make variable usable ( @twz123)
securityCVE-2026-40912 (Advisory GHSA-6jwx-7vp4-9847)
securityCVE-2026-39858 (Advisory GHSA-5m6w-wvh7-57vm)
securityCVE-2026-35051 (Advisory GHSA-6384-m2mw-rf54)
securityCVE-2026-41263 (Advisory GHSA-6x2q-h3cr-8j2h)
securityCVE-2026-41174 (Advisory GHSA-xhjw-95fp-8vgq)
fix[middleware, authentication] Remove map lookup making the basic auth notFoundSecret empty ( @rtribotte)
fix[middleware, authentication] Fix trustForwardHeader on forward auth middleware ( @juliens)
fix[middleware, authentication] Cleanup and make ForwardAuth logs consistent ( @kevinpollet)
fix[middleware] Remove untrusted X headers with underscores ( @rtribotte)
fix[middleware] Sanitize the request URL after stripping the prefix ( @kevinpollet)
fix[k8s/crd, k8s] Honor allowCrossNamespace with chain middleware CRD ( @rtribotte)
securityCVE-2026-33433 (Advisory GHSA-qr99-7898-vr7c)
securityCVE-2026-33186 (Advisory GHSA-46wh-3698-f2cx)
fix[grpc] Bump google.golang.org/grpc to v1.79.3 ( @mmatur)
fix[middleware, authentication] Prevent duplicate user headers in basic and digest auth middleware ( @juliens)
fix[middleware] Fix StripPrefix and StripPrefixRegex to slice the prefix using encoded prefix length ( @gndz07)
securityCVE-2026-32595 (Advisory GHSA-g3hg-j4jv-cwfr)
securityCVE-2026-32305 (Advisory GHSA-wvvq-wgcr-9q48)
fix[http] Add maxResponseBodySize configuration on HTTP provider ( @gndz07)
fix[tls] Support fragmented TLS client hello ( @rtribotte)
fix[middleware, authentication] Make basic auth check timing constant ( @rtribotte)
otherBump mkdocs-traefiklabs to use consent mode ( @darkweaver87)
securityCVE-2026-27141 (Advisory GHSA-4hjq-9h5c-252j)
fix[docker] Bump Docker and OpenTelemetry dependencies ( by mmatur)
fix[server] Bump golang.org/x/net to v0.51.0 ( by kevinpollet)
securityCVE-2026-26998 (Advisory GHSA-fw45-f5q2-2p4x)
securityCVE-2026-26999 (Advisory GHSA-xw98-5q62-jx94)
securityCVE-2026-29054 (Advisory GHSA-92mv-8f8w-wq52)
fix[middleware] Fix case sensitivity on x-forwarded headers for Connection ( by LBF38)
fix[middleware, authentication] Add maxResponseBodySize configuration to forwardAuth middleware ( by gndz07)
fix[server] Fix TLS handshake error handling ( by juliens)
securityCVE-2025-68121 (Advisory GHSA-gv8r-9rw9-9697)
fix[healthcheck] Validate healthcheck path configuration ( by rtribotte)
fix[tls,server] Cap TLS record length to RFC 8446 limit in ClientHello peeking ( by mmatur)
fix[service] Avoid recursion with services ( by juliens)
fix[webui] Bump dependencies of documentation and webui ( by gndz07)
breakingRemove extra dots in migration guide ( by rtribotte)
securitywarning: Breaking change :warning: As explained in the comment left on the CVE-2025-66490 fix, this new hotfix version makes the behavior opt-in. As a result, this release is breaking compared to the previous hotfix versions since v2.11.32, but it restores by default the behavior that existed…
securityCVE-2026-22045 (Advisory GHSA-cwjm-3f7h-9hwqj)
fix[acme] Add timeout to ACME-TLS/1 challenge handshake ( by LBF38)
fix[server] Make encoded character options opt-in ( by gndz07)
fix[server] Fix deny encoded characters ( by rtribotte)
fix[server] Print access logs for rejected requests and warn about new behavior ( by rtribotte)
otherClarify doc about encoded characters rejection ( by rtribotte)
fixFix encoded characters entryPoint option documentation ( by rtribotte)
fixFix encoded characters option documentation ( by kevinpollet)
securityCVE-2025-66490 (Advisory GHSA-gm3x-23wp-hc2c): Breaking Change please read the migration guide.
fix[server] Reject suspicious encoded characters ( by rtribotte)
fix[plugins] Validate plugin module name ( by kevinpollet)
fix[http3] Bump github.com/quic-go/quic-go to v0.57.1 ( by GreyXor)
fix[http3] Bump github.com/quic-go/quic-go to v0.57.0 ( by GreyXor)
fix[server] Bump golang.org/x/crypto to v0.45.0 ( by kevinpollet)
securityUpdate SECURITY.md to streamline information ( by emilevauge)
securityUpdate SECURITY.md ( by cwayne18)
fix[docker,docker/swarm] Auto-negotiate Docker API version ( by kevinpollet)
fix[http3] Bump github.com/quic-go/quic-go to v0.55.0 ( by kevinpollet)
fix[kv] Fix KV key name used to check if connection is alive ( by kevinpollet)
fix[server] Bump golang.org/x/net to v0.46.0 ( by kevinpollet)
fix[tracing] Bump gopkg.in/DataDog/dd-trace-go.v1 to v1.74.6 ( by hannahkm)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.25.2 ( by ldez)
fix[docker] Bump github.com/docker/docker to v28.3.3 ( by kevinpollet)
fixFix invalid links in documentation ( by mloiseleur)
otherUpdate releases docs for v3.5 ( by jnoordsij)
fix[logs] Redact logged install configuration ( by jspdown)
fix[plugins] Fix client arbitrary file access during archive extraction zipslip ( by odaysec)
fix[server] Disable MPTCP by default ( by rtribotte)
other[k8s/crd,k8s] Remove all mentions of ordering for TLSOption CurvePreferences field ( by jnoordsij)
fixBump github.com/go-viper/mapstructure/v2 to v2.3.0 ( by kevinpollet)
fix[middleware] Do not log redis sentinel username and password ( by kevinpollet)
other[kv] Fix KV reference rendering ( by rtribotte)
other[middleware,k8s/crd] Fix typo in redirect middleware documentation ( by rtribotte)
otherUpdate supported versions ( by jnoordsij)