Traefik 2.11.36 → 2.11.46

9 releases · 0 breaking changes · 17 security fixes · 4 advisories fixed

17security0breaking0deprecated0feature25fix

Is 2.11.36 affected? · What changed up to 3.7.16

Vulnerabilities fixed by this upgrade

6.4 GHSA-rh7m-2m44-x32f Traefik: Kubernetes Ingress and Service annotations allow cross-namespace references to Middlewares, ServersTransports, and TLSOptions
6.4 CVE-2026-44774 Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false
6.9 CVE-2026-41181 Errors middleware forwards Authorization and Cookie headers to separate error page service
7.5 CVE-2026-29054 Case-Sensitive Bypass in Connection Header Allows Removal of X-Forwarded Headers

Breaking changes

None in the release notes.

Security changes

security CVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc) in 2.11.46
security Advisory GHSA-rh7m-2m44-x32f in 2.11.46
security CVE-2026-41181 (Advisory GHSA-p6hg-qh38-555r) in 2.11.44
security CVE-2026-40912 (Advisory GHSA-6jwx-7vp4-9847) in 2.11.43
security CVE-2026-39858 (Advisory GHSA-5m6w-wvh7-57vm) in 2.11.43
security CVE-2026-35051 (Advisory GHSA-6384-m2mw-rf54) in 2.11.43
security CVE-2026-41263 (Advisory GHSA-6x2q-h3cr-8j2h) in 2.11.43
security CVE-2026-41174 (Advisory GHSA-xhjw-95fp-8vgq) in 2.11.43
security CVE-2026-33433 (Advisory GHSA-qr99-7898-vr7c) in 2.11.42
security CVE-2026-33186 (Advisory GHSA-46wh-3698-f2cx) in 2.11.42
security CVE-2026-32595 (Advisory GHSA-g3hg-j4jv-cwfr) in 2.11.41
security CVE-2026-32305 (Advisory GHSA-wvvq-wgcr-9q48) in 2.11.41
security CVE-2026-27141 (Advisory GHSA-4hjq-9h5c-252j) in 2.11.40
security CVE-2026-26998 (Advisory GHSA-fw45-f5q2-2p4x) in 2.11.38
security CVE-2026-26999 (Advisory GHSA-xw98-5q62-jx94) in 2.11.38
security CVE-2026-29054 (Advisory GHSA-92mv-8f8w-wq52) in 2.11.38
security CVE-2025-68121 (Advisory GHSA-gv8r-9rw9-9697) in 2.11.37

Every release in between

2.11.46 May 11, 2026 Release notes ↗

securityCVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc)

securityAdvisory GHSA-rh7m-2m44-x32f

fix[k8s/ingress, k8s/crd, k8s/gatewayapi] Add CrossProviderNamespaces option ( @rtribotte)

fix[k8s/crd] Fix cross-provider ref check for Kubernetes CRD provider ( @rtribotte)

2.11.45 May 5, 2026 Release notes ↗

fix[k8s/crd] Remove cross-provider sanitization for Kubernetes service loading ( @rtribotte)

fix[docker, ecs] Migrate to github.com/moby/moby modules ( @mmatur)

2.11.44 Apr 29, 2026 Release notes ↗

securityCVE-2026-41181 (Advisory GHSA-p6hg-qh38-555r)

fix[middleware] Add errorRequestHeaders option to Errors middleware ( @gndz07)

fix[acme] Bump github.com/go-acme/lego to v4.35.2 ( @mmatur)

otherMake FLAGS Make variable usable ( @twz123)

2.11.43 Apr 22, 2026 Release notes ↗

securityCVE-2026-40912 (Advisory GHSA-6jwx-7vp4-9847)

securityCVE-2026-39858 (Advisory GHSA-5m6w-wvh7-57vm)

securityCVE-2026-35051 (Advisory GHSA-6384-m2mw-rf54)

securityCVE-2026-41263 (Advisory GHSA-6x2q-h3cr-8j2h)

securityCVE-2026-41174 (Advisory GHSA-xhjw-95fp-8vgq)

fix[middleware, authentication] Remove map lookup making the basic auth notFoundSecret empty ( @rtribotte)

fix[middleware, authentication] Fix trustForwardHeader on forward auth middleware ( @juliens)

fix[middleware, authentication] Cleanup and make ForwardAuth logs consistent ( @kevinpollet)

fix[middleware] Remove untrusted X headers with underscores ( @rtribotte)

fix[middleware] Sanitize the request URL after stripping the prefix ( @kevinpollet)

fix[k8s/crd, k8s] Honor allowCrossNamespace with chain middleware CRD ( @rtribotte)

2.11.42 Mar 26, 2026 Release notes ↗

securityCVE-2026-33433 (Advisory GHSA-qr99-7898-vr7c)

securityCVE-2026-33186 (Advisory GHSA-46wh-3698-f2cx)

fix[grpc] Bump google.golang.org/grpc to v1.79.3 ( @mmatur)

fix[middleware, authentication] Prevent duplicate user headers in basic and digest auth middleware ( @juliens)

fix[middleware] Fix StripPrefix and StripPrefixRegex to slice the prefix using encoded prefix length ( @gndz07)

2.11.41 Mar 18, 2026 Release notes ↗

securityCVE-2026-32595 (Advisory GHSA-g3hg-j4jv-cwfr)

securityCVE-2026-32305 (Advisory GHSA-wvvq-wgcr-9q48)

fix[http] Add maxResponseBodySize configuration on HTTP provider ( @gndz07)

fix[tls] Support fragmented TLS client hello ( @rtribotte)

fix[middleware, authentication] Make basic auth check timing constant ( @rtribotte)

otherBump mkdocs-traefiklabs to use consent mode ( @darkweaver87)

2.11.40 Mar 6, 2026 Release notes ↗

securityCVE-2026-27141 (Advisory GHSA-4hjq-9h5c-252j)

fix[docker] Bump Docker and OpenTelemetry dependencies ( by mmatur)

fix[server] Bump golang.org/x/net to v0.51.0 ( by kevinpollet)

2.11.38 Feb 23, 2026 Release notes ↗

securityCVE-2026-26998 (Advisory GHSA-fw45-f5q2-2p4x)

securityCVE-2026-26999 (Advisory GHSA-xw98-5q62-jx94)

securityCVE-2026-29054 (Advisory GHSA-92mv-8f8w-wq52)

fix[middleware] Fix case sensitivity on x-forwarded headers for Connection ( by LBF38)

fix[middleware, authentication] Add maxResponseBodySize configuration to forwardAuth middleware ( by gndz07)

fix[server] Fix TLS handshake error handling ( by juliens)

2.11.37 Feb 11, 2026 Release notes ↗

securityCVE-2025-68121 (Advisory GHSA-gv8r-9rw9-9697)

fix[healthcheck] Validate healthcheck path configuration ( by rtribotte)

fix[tls,server] Cap TLS record length to RFC 8446 limit in ClientHello peeking ( by mmatur)