Traefik 2.11.36 → 2.11.56

18 releases · 0 breaking changes · 28 security fixes · 15 advisories fixed

28security0breaking0deprecated2feature66fix

Is 2.11.36 affected? · What changed up to 3.7.16

Vulnerabilities fixed by this upgrade

6.4 GHSA-rh7m-2m44-x32f Traefik: Kubernetes Ingress and Service annotations allow cross-namespace references to Middlewares, ServersTransports, and TLSOptions
5.3 CVE-2026-88012 respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded
5.3 CVE-2026-88011 ForwardAuth identity spoofing via dot-form header alias
8.2 GHSA-g55h-rg46-x9c5 TLS option confusion in multi-host routers can bypass mTLS for protected hosts
9.3 GHSA-5w68-77r2-r64c Complete authentication bypass in the `digestAuth` middleware
4.8 CVE-2026-71325 `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef
7.0 CVE-2026-71324 Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool
7.8 GHSA-cxjq-mrr5-89rv Authentication Bypass via Path Traversal in ReplacePathRegex Middleware
high CVE-2026-54763 Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
6.9 CVE-2026-54764 ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false
7.8 CVE-2026-53622 HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts
7.8 CVE-2026-48020 Traefik StripPrefix Route-Level Auth Bypass via Path Normalization
6.4 CVE-2026-44774 Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false
6.9 CVE-2026-41181 Errors middleware forwards Authorization and Cookie headers to separate error page service
7.5 CVE-2026-29054 Case-Sensitive Bypass in Connection Header Allows Removal of X-Forwarded Headers

Breaking changes

None in the release notes.

Security changes

security Advisory GHSA-7ghq-v6jf-g56c in 2.11.56
security Advisory GHSA-rf44-j88r-hh8c in 2.11.56
security Advisory GHSA-5w68-77r2-r64c in 2.11.55
security Advisory GHSA-g55h-rg46-x9c5 in 2.11.55
security Advisory GHSA-62fc-8686-hfmq in 2.11.54
security Advisory GHSA-3ccp-42pg-hgv6 in 2.11.53
security Advisory GHSA-cxjq-mrr5-89rv in 2.11.52
security CVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5) in 2.11.51
security CVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m) in 2.11.51
security [security] Add HTTP/2 header memory exhaustion security documentation ( @emilevauge) in 2.11.51
security CVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2) in 2.11.48
security CVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc) in 2.11.46
security Advisory GHSA-rh7m-2m44-x32f in 2.11.46
security CVE-2026-41181 (Advisory GHSA-p6hg-qh38-555r) in 2.11.44
security CVE-2026-40912 (Advisory GHSA-6jwx-7vp4-9847) in 2.11.43
security CVE-2026-39858 (Advisory GHSA-5m6w-wvh7-57vm) in 2.11.43
security CVE-2026-35051 (Advisory GHSA-6384-m2mw-rf54) in 2.11.43
security CVE-2026-41263 (Advisory GHSA-6x2q-h3cr-8j2h) in 2.11.43
security CVE-2026-41174 (Advisory GHSA-xhjw-95fp-8vgq) in 2.11.43
security CVE-2026-33433 (Advisory GHSA-qr99-7898-vr7c) in 2.11.42
security CVE-2026-33186 (Advisory GHSA-46wh-3698-f2cx) in 2.11.42
security CVE-2026-32595 (Advisory GHSA-g3hg-j4jv-cwfr) in 2.11.41
security CVE-2026-32305 (Advisory GHSA-wvvq-wgcr-9q48) in 2.11.41
security CVE-2026-27141 (Advisory GHSA-4hjq-9h5c-252j) in 2.11.40
security CVE-2026-26998 (Advisory GHSA-fw45-f5q2-2p4x) in 2.11.38
security CVE-2026-26999 (Advisory GHSA-xw98-5q62-jx94) in 2.11.38
security CVE-2026-29054 (Advisory GHSA-92mv-8f8w-wq52) in 2.11.38
security CVE-2025-68121 (Advisory GHSA-gv8r-9rw9-9697) in 2.11.37

Every release in between

2.11.56 Aug 26, 2026 Release notes ↗

securityAdvisory GHSA-7ghq-v6jf-g56c

securityAdvisory GHSA-rf44-j88r-hh8c

fix[http3] Apply read timeout, idle timeout, and max header bytes for HTTP/3 ( @gndz07)

fix[server] Add an entry point option to handle request headers with aliasing names ( @rtribotte)

fix[tcp, udp] Reject negative weights in TCP and UDP weighted services ( @rtribotte)

fixBump etcd client modules to v3.5.33 ( @mmatur)

2.11.55 Aug 18, 2026 Release notes ↗

securityAdvisory GHSA-5w68-77r2-r64c

securityAdvisory GHSA-g55h-rg46-x9c5

fix[k8s/crd] Prevent generated name collisions in the Kubernetes CRD provider ( @rtribotte)

fix[k8s/crd] Add an option to restrict the namespace of the default TLS resources ( @rtribotte)

fix[k8s/crd] Scope generated Kubernetes Service names to their parent in the CRD provider ( @rtribotte)

fix[k8s/crd] Add safe naming option to avoid collisions for Kubernetes CRD provider ( @gndz07)

fix[k8s/gatewayapi] Fix Gateway API router rules ( @rtribotte)

fix[middleware, authentication] Bump github.com/containous/go-http-auth to b975dcaa8c48 ( @kevinpollet)

fix[tls] Add an option to disable the fallback to the default TLS options ( @rtribotte)

fixBump golang.org/x dependencies ( @mmatur)

2.11.54 Jul 31, 2026 Release notes ↗

securityAdvisory GHSA-62fc-8686-hfmq

fix[tracing] Bump github.com/DataDog/dd-trace-go/v2 to 2.8.1 ( @kevinpollet)

fixBump golang.org/x/text to v0.40.0 and golang.org/x/net v0.57.0 ( @mmatur)

fix[k8s/crd] Fix cross-namespace service reference check in Kubernetes CRD provider ( @gndz07)

fix[middleware] Bump github.com/klauspost/compress to v1.18.7 ( @mmatur)

2.11.53 Jul 24, 2026 Release notes ↗

securityAdvisory GHSA-3ccp-42pg-hgv6

fix[middleware, k8s/crd] Add missing ErrorRequestHeaders field to CRDs ( @kevinpollet)

fix[server] Defer the CONNECT payload until the backend accepts the tunnel ( @sdelicata)

fix[server] Bump google.golang.org/grpc to v1.82.1 ( @piscue)

fix[server] Do not add back CONNECT requests to the pool ( @kevinpollet)

featureAdd a migration note for CONNECT requests ( @kevinpollet)

2.11.52 Jul 8, 2026 Release notes ↗

securityAdvisory GHSA-cxjq-mrr5-89rv

fix[middleware] Sanitize replaced path in ReplacePathRegex middleware ( @kevinpollet)

fix[acme] Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 ( @rtribotte)

fix[otel] Bump go.opentelemetry.io/otel to v1.44.0 ( @rtribotte)

fixFix changelog v2.11.51 ( @mmatur)

2.11.51 Jun 30, 2026 Release notes ↗

securityCVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5)

securityCVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m)

fix[acme] Bump github.com/go-acme/lego/v5 ( @juliens)

fix[middleware, authentication] Fix x-forwarded-port in forward-auth ( @juliens)

fix[middleware, authentication] Add an option to remove request headers with underscores ( @youkoulayley)

fix[webui] Bump axios to v1.18.0 ( @gndz07)

fixConfigurable max request header size ( @juliens)

security[security] Add HTTP/2 header memory exhaustion security documentation ( @emilevauge)

featureAdds documentations on maxHeaderBytes ( @juliens)

2.11.50 Jun 10, 2026 Release notes ↗

fix[tls] Fix routers with same host, different tlsoptions on different entryPoint ( @juliens)

fix[tls] Fix snicheck for routers with no hosts ( @rtribotte)

2.11.49 Jun 5, 2026 Release notes ↗

fix[http3] Bump github.com/quic-go/quic-go to v0.59.1 ( @rtribotte)

fix[webui] Bump axios to v1.17.0 ( @gndz07)

fix[tls] Fix snicheck with keepalive ( @juliens)

2.11.48 Jun 4, 2026 Release notes ↗

securityCVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2)

fix[tls] Compute resolved tlsOptions after applying models ( @rtribotte)

fix[middleware, authentication] Add error on basic auth build if users is empty ( @rtribotte)

fix[k8s/ingress] Avoid ingress path matcher injection and backport 11d251415 ( @rtribotte)

fix[server] Move snicheck to ctx instead of simulated routing ( @juliens)

fix[middleware] Reject requests with different paths after StripPrefix and StripPrefixRegex normalisation ( @rtribotte)

fix[server] Bump golang.org/x/net to v0.55.0 ( @kevinpollet)

fix[server] Bump golang.org/x/crypto to v0.52.0 ( @rtribotte)

2.11.46 May 11, 2026 Release notes ↗

securityCVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc)

securityAdvisory GHSA-rh7m-2m44-x32f

fix[k8s/ingress, k8s/crd, k8s/gatewayapi] Add CrossProviderNamespaces option ( @rtribotte)

fix[k8s/crd] Fix cross-provider ref check for Kubernetes CRD provider ( @rtribotte)

2.11.45 May 5, 2026 Release notes ↗

fix[k8s/crd] Remove cross-provider sanitization for Kubernetes service loading ( @rtribotte)

fix[docker, ecs] Migrate to github.com/moby/moby modules ( @mmatur)

2.11.44 Apr 29, 2026 Release notes ↗

securityCVE-2026-41181 (Advisory GHSA-p6hg-qh38-555r)

fix[middleware] Add errorRequestHeaders option to Errors middleware ( @gndz07)

fix[acme] Bump github.com/go-acme/lego to v4.35.2 ( @mmatur)

otherMake FLAGS Make variable usable ( @twz123)

2.11.43 Apr 22, 2026 Release notes ↗

securityCVE-2026-40912 (Advisory GHSA-6jwx-7vp4-9847)

securityCVE-2026-39858 (Advisory GHSA-5m6w-wvh7-57vm)

securityCVE-2026-35051 (Advisory GHSA-6384-m2mw-rf54)

securityCVE-2026-41263 (Advisory GHSA-6x2q-h3cr-8j2h)

securityCVE-2026-41174 (Advisory GHSA-xhjw-95fp-8vgq)

fix[middleware, authentication] Remove map lookup making the basic auth notFoundSecret empty ( @rtribotte)

fix[middleware, authentication] Fix trustForwardHeader on forward auth middleware ( @juliens)

fix[middleware, authentication] Cleanup and make ForwardAuth logs consistent ( @kevinpollet)

fix[middleware] Remove untrusted X headers with underscores ( @rtribotte)

fix[middleware] Sanitize the request URL after stripping the prefix ( @kevinpollet)

fix[k8s/crd, k8s] Honor allowCrossNamespace with chain middleware CRD ( @rtribotte)

2.11.42 Mar 26, 2026 Release notes ↗

securityCVE-2026-33433 (Advisory GHSA-qr99-7898-vr7c)

securityCVE-2026-33186 (Advisory GHSA-46wh-3698-f2cx)

fix[grpc] Bump google.golang.org/grpc to v1.79.3 ( @mmatur)

fix[middleware, authentication] Prevent duplicate user headers in basic and digest auth middleware ( @juliens)

fix[middleware] Fix StripPrefix and StripPrefixRegex to slice the prefix using encoded prefix length ( @gndz07)

2.11.41 Mar 18, 2026 Release notes ↗

securityCVE-2026-32595 (Advisory GHSA-g3hg-j4jv-cwfr)

securityCVE-2026-32305 (Advisory GHSA-wvvq-wgcr-9q48)

fix[http] Add maxResponseBodySize configuration on HTTP provider ( @gndz07)

fix[tls] Support fragmented TLS client hello ( @rtribotte)

fix[middleware, authentication] Make basic auth check timing constant ( @rtribotte)

otherBump mkdocs-traefiklabs to use consent mode ( @darkweaver87)

2.11.40 Mar 6, 2026 Release notes ↗

securityCVE-2026-27141 (Advisory GHSA-4hjq-9h5c-252j)

fix[docker] Bump Docker and OpenTelemetry dependencies ( by mmatur)

fix[server] Bump golang.org/x/net to v0.51.0 ( by kevinpollet)

2.11.38 Feb 23, 2026 Release notes ↗

securityCVE-2026-26998 (Advisory GHSA-fw45-f5q2-2p4x)

securityCVE-2026-26999 (Advisory GHSA-xw98-5q62-jx94)

securityCVE-2026-29054 (Advisory GHSA-92mv-8f8w-wq52)

fix[middleware] Fix case sensitivity on x-forwarded headers for Connection ( by LBF38)

fix[middleware, authentication] Add maxResponseBodySize configuration to forwardAuth middleware ( by gndz07)

fix[server] Fix TLS handshake error handling ( by juliens)

2.11.37 Feb 11, 2026 Release notes ↗

securityCVE-2025-68121 (Advisory GHSA-gv8r-9rw9-9697)

fix[healthcheck] Validate healthcheck path configuration ( by rtribotte)

fix[tls,server] Cap TLS record length to RFC 8446 limit in ClientHello peeking ( by mmatur)