Traefik 3.6.12 → 3.7.11

23 releases · 5 breaking changes · 50 security fixes · 19 advisories fixed

50security5breaking1deprecated48feature196fix

Is 3.6.12 affected? · What changed up to 3.7.16

Vulnerabilities fixed by this upgrade

6.4 GHSA-rh7m-2m44-x32f Traefik: Kubernetes Ingress and Service annotations allow cross-namespace references to Middlewares, ServersTransports, and TLSOptions
8.2 GHSA-g55h-rg46-x9c5 TLS option confusion in multi-host routers can bypass mTLS for protected hosts
9.3 GHSA-5w68-77r2-r64c Complete authentication bypass in the `digestAuth` middleware
2.1 CVE-2026-71326 BasicAuth singleflight key collision allows authenticated identity spoofing
4.8 CVE-2026-71325 `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef
7.6 CVE-2026-71327 Gateway API route identity collision allows cross-namespace backend hijacking
7.0 CVE-2026-71324 Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool
7.8 GHSA-cxjq-mrr5-89rv Authentication Bypass via Path Traversal in ReplacePathRegex Middleware
high CVE-2026-54763 Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
6.9 CVE-2026-54764 ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false
7.8 CVE-2026-53622 HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts
7.8 CVE-2026-48020 Traefik StripPrefix Route-Level Auth Bypass via Path Normalization
6.4 CVE-2026-44774 Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false
6.9 CVE-2026-41181 Errors middleware forwards Authorization and Cookie headers to separate error page service
7.8 CVE-2026-40912 StripPrefixRegex auth bypass via Path/RawPath desync
7.8 CVE-2026-35051 ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth
7.8 CVE-2026-39858 Forwarded alias spoofing top pre-auth decision bypass
6.3 CVE-2026-41263 BasicAuth middleware: timing side-channel vulnerability
4.8 CVE-2026-41174 Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding

Breaking changes

breaking Remove retired Go Report Card badge ( @yardenshoham) in 3.7.11
breaking Remove unsupported servers[n].address from TCP label examples ( @sheddy-traefik) in 3.7.0
breaking Add a Breaking change note to the changelog ( @nmengin) in 3.7.0
breaking Remove extra dots in migration guide ( @rtribotte) in 3.7.0
breaking Remove extraneous dots in migration guide ( @dathbe) in 3.7.0

Security changes

security Advisory GHSA-5w68-77r2-r64c in 3.7.11
security Advisory GHSA-g55h-rg46-x9c5 in 3.7.11
security Advisory GHSA-j994-9gqj-9hwq in 3.7.11
security Advisory GHSA-m6wx-622r-48r9 in 3.7.11
security Advisory GHSA-fgjj-px3w-67xx in 3.7.10
security Advisory GHSA-62fc-8686-hfmq in 3.7.10
security Advisory GHSA-6765-c87h-8mrf in 3.7.10
security Advisory GHSA-3ccp-42pg-hgv6 in 3.7.9
security Advisory GHSA-8rxv-jg7p-wvg3 in 3.7.8
security Advisory GHSA-cxjq-mrr5-89rv in 3.7.7
security Advisory GHSA-42cj-m3vj-89wv in 3.7.7
security Advisory GHSA-qq9q-x9w4-chhj in 3.7.7
security CVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5) in 3.7.6
security CVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m) in 3.7.6
security CVE-2026-54765 (Advisory GHSA-6p8f-p8j2-rqmv) in 3.7.6
security [security] Add HTTP/2 header memory exhaustion security documentation ( @emilevauge) in 3.7.6
security CVE-2026-54761 (Advisory GHSA-3g6v-2r68-prfc) in 3.7.5
security CVE-2026-54762 (Advisory GHSA-4mr2-fg2p-w63c) in 3.7.5
security CVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2) in 3.7.3
security CVE-2026-48491 (Advisory GHSA-5r4w-85f3-pw66) in 3.7.3
security CVE-2026-53622 (Advisory GHSA-9cr8-q42q-g8m7) in 3.7.3
security CVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc) in 3.7.1
security Advisory GHSA-rh7m-2m44-x32f in 3.7.1
security Update vulnerability submission guidelines ( @emilevauge) in 3.7.0
security [k8s] Improve the multi tenant security note ( @nmengin) in 3.7.0
security Add vulnerability submission quality guidelines ( @emilevauge) in 3.7.0
security [k8s] Improve the K8S multi-tenancy security note ( @nmengin) in 3.7.0
security Bring back security section on API & Dashboard documentation page ( @gndz07) in 3.7.0
security Update SECURITY.md ( @cwayne18) in 3.7.0
security Update SECURITY.md to streamline information ( @emilevauge) in 3.7.0
security Advisory GHSA-fgjj-px3w-67xx in 3.6.25
security Advisory GHSA-62fc-8686-hfmq in 3.6.25
security Advisory GHSA-6765-c87h-8mrf in 3.6.25
security Advisory GHSA-3ccp-42pg-hgv6 in 3.6.24
security Advisory GHSA-cxjq-mrr5-89rv in 3.6.23
security Advisory GHSA-42cj-m3vj-89wv in 3.6.23
security CVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5) in 3.6.22
security CVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m) in 3.6.22
security [security] Add HTTP/2 header memory exhaustion security documentation ( @emilevauge) in 3.6.22
security CVE-2026-54761 (Advisory GHSA-3g6v-2r68-prfc) in 3.6.21
security CVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2) in 3.6.19
security CVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc) in 3.6.17
security Advisory GHSA-rh7m-2m44-x32f in 3.6.17
security CVE-2026-41181 (Advisory GHSA-p6hg-qh38-555r) in 3.6.15
security CVE-2026-40912 (Advisory GHSA-6jwx-7vp4-9847) in 3.6.14
security CVE-2026-39858 (Advisory GHSA-5m6w-wvh7-57vm) in 3.6.14
security CVE-2026-35051 (Advisory GHSA-6384-m2mw-rf54) in 3.6.14
security CVE-2026-41263 (Advisory GHSA-6x2q-h3cr-8j2h) in 3.6.14
security CVE-2026-41174 (Advisory GHSA-xhjw-95fp-8vgq) in 3.6.14
security Update vulnerability submission guidelines ( @emilevauge) in 3.6.14

Deprecations

deprecated Fix migration guide URLs in deprecation notice ( @alexmar07) in 3.7.0

Every release in between

3.7.11 Aug 19, 2026 Release notes ↗

securityAdvisory GHSA-5w68-77r2-r64c

securityAdvisory GHSA-g55h-rg46-x9c5

securityAdvisory GHSA-j994-9gqj-9hwq

securityAdvisory GHSA-m6wx-622r-48r9

fix[fastproxy] Reject out-of-range status codes from backends when using FastProxy ( @gndz07)

fix[http3] Bump github.com/quic-go/quic-go to v0.61.0 ( @jnoordsij)

fix[k8s/crd] Prevent generated name collisions in the Kubernetes CRD provider ( @rtribotte)

fix[k8s/crd] Add an option to restrict the namespace of the default TLS resources ( @rtribotte)

fix[k8s/crd] Scope generated Kubernetes Service names to their parent in the CRD provider ( @rtribotte)

fix[k8s/crd] Name failover generated services after the referenced Kubernetes Service ( @rtribotte)

fix[k8s/crd] Add safe naming option to avoid collisions for Kubernetes CRD provider ( @gndz07)

fix[k8s/gatewayapi] Preserve encoded path segments in Gateway API URLRewrite and RequestRedirect ( @gndz07)

fix[k8s/gatewayapi] Fix Gateway API router rules ( @rtribotte)

fix[k8s/ingress-nginx] Dedupe client-auth TLS options across ingresses sharing a host for ingress-nginx provider ( @gndz07)

fix[k8s/ingress-nginx] Apply auth, custom-headers, custom errors and ssl-redirect to ingress default backend ( @rtribotte)

fix[k8s/ingress-nginx] Honor asDefault and exclude internal entrypoints from default selection for ingress-nginx provider ( @gndz07)

fix[k8s/ingress] Enforce crossProviderNamespace for Kubernetes Ingress service middleware ( @gndz07)

fix[middleware, authentication] Bump github.com/containous/go-http-auth to b975dcaa8c48 ( @kevinpollet)

fix[tls] Add an option to disable the fallback to the default TLS options ( @rtribotte)

fixBump golang.org/x dependencies ( @mmatur)

other[accesslogs] Clarify OriginStatus and DownstreamStatus in access logs documentation ( @rtribotte)

other[api] Fix doubled word in API/dashboard reference docs ( @latent-9)

other[docker] Remove :ro from docker.sock ( @bluepuma77)

other[k8s/gatewayapi] Clarify v3.7.10 migration guide for Gateway API 1.6.1 ( @rtribotte)

other[k8s/gatewayapi] Document the Experimental Channel CRDs requirement of the Kubernetes Gateway provider ( @rtribotte)

other[k8s/ingress-nginx] Docs: Update supported server snippet directives ( @rtsui-harmonicinc)

feature[middleware] Add rejectStatusCode to the ipAllowList middleware configuration example ( @amazon7737)

other[middleware] Mark the errors middleware service option as required ( @lazerg)

other[tls] Document the TLS options conflict resolution ( @rtribotte)

other[tls] Clarify router TLS replaces entrypoint TLS ( @sornapudisuresh)

otherDocument Redis keyspace notifications requirement ( @omkar619-dev)

breakingRemove retired Go Report Card badge ( @yardenshoham)

otherRestore the systemd socket activation documentation ( @lazerg)

otherUpdate version support policy starting with v3.6 ( @nmengin)

3.7.10 Jul 31, 2026 Release notes ↗

securityAdvisory GHSA-fgjj-px3w-67xx

securityAdvisory GHSA-62fc-8686-hfmq

securityAdvisory GHSA-6765-c87h-8mrf

fix[acme] Bump github.com/go-acme/lego/v5 to v5.3.1 ( @ldez)

fix[middleware, authentication] Fix auth singleflight key collision ( @mmatur)

fix[k8s/gatewayapi] Avoid router name collisions in Kubernetes Gateway API provider ( @gndz07)

fix[tracing] Bump github.com/DataDog/dd-trace-go/v2 to 2.8.1 ( @kevinpollet)

fixBump golang.org/x/text to v0.40.0 and golang.org/x/net v0.57.0 ( @mmatur)

fix[k8s/crd] Fix cross-namespace service reference check in Kubernetes CRD provider ( @gndz07)

fix[middleware] Bump github.com/klauspost/compress to v1.18.7 ( @mmatur)

fix[k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.6.1 ( @rtribotte)

other[k8s/ingress-nginx] Clarify auth-url/rewrite-target interaction on ingress-nginx provider ( @gndz07)

3.7.9 Jul 24, 2026 Release notes ↗

securityAdvisory GHSA-3ccp-42pg-hgv6

fix[k8s/ingress-nginx] Fix redirect with use-regex in IngressNGINX provider ( @AmariahAK)

fix[middleware] Disable Zstd support in the gzhttp wrapper ( @kevinpollet)

fix[server] Defer the CONNECT payload until the backend accepts the tunnel ( @sdelicata)

fix[server] Discard CONNECT body in forwardauth and reject CONNECT requests with fast proxy ( @sdelicata)

fix[server] Bump google.golang.org/grpc to v1.82.1 ( @piscue)

fix[server] Do not add back CONNECT requests to the pool ( @kevinpollet)

other[k8s/gatewayapi] Document Gateway API generated service names change in the migration guide ( @rtribotte)

other[k8s/ingress-nginx] Fix typo in nginx annotation proxy-buffer-numbers ( @fischerman)

featureAdd a migration note for CONNECT requests ( @kevinpollet)

3.7.8 Jul 15, 2026 Release notes ↗

securityAdvisory GHSA-8rxv-jg7p-wvg3

fix[middleware, k8s/crd] Add missing ErrorRequestHeaders field to CRDs ( @kevinpollet)

fix[k8s/ingress-nginx] Sanitize rewritten target on ingress-nginx provider ( @gndz07)

fix[logs] Remove unrelated error from nonexistent cert resolver log ( @ArthurHlt)

fix[middleware] Fix panic in retry middleware with Websockets ( @juliens)

other[k8s] Align certificateRef and indicate ports ( @veenoise)

other[rules] Fix syntax notes in routing rule documentation ( @stevenlele)

other[k8s/crd] Fix duplicated options table in ServersTransport CRD reference ( @rachana5)

3.7.7 Jul 8, 2026 Release notes ↗

securityAdvisory GHSA-cxjq-mrr5-89rv

securityAdvisory GHSA-42cj-m3vj-89wv

securityAdvisory GHSA-qq9q-x9w4-chhj

fix[middleware, k8s/ingress-nginx] Add app-root middleware with nginx variable interpolation ( @dfeinblatt)

fix[rules] Fix consistency between HostSNI() and Host() ( @juliens)

fix[k8s, k8s/gatewayapi] Fix ExtensionRef filters on backendRefs to resolve against the HTTPRoute namespace ( @gndz07)

fix[middleware] Fix handle empty unknown-length bodies in mirroring ( @amazon7737)

fix[k8s/crd] Fix cross-provider ref check for TCP ServersTransport in Kubernetes CRD provider ( @gndz07)

fix[middleware] Sanitize replaced path in ReplacePathRegex middleware ( @kevinpollet)

fix[acme] Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 ( @rtribotte)

fix[otel] Bump go.opentelemetry.io/otel to v1.44.0 ( @rtribotte)

fix[k8s] Fix panic when endpointslice port value or name is nil ( @kevinpollet)

fixFix version in migration guide ( @kevinpollet)

fixFix changelog v2.11.51 ( @mmatur)

featureAdd v3.7 to supported version docs ( @jnoordsij)

fixFix some function names in comments ( @blackflytech)

featureAdd @nandorKollar as a current maintainer ( @emilevauge)

featureAdd @amazon7737 as a current maintainer ( @emilevauge)

other[middleware] Clarify buffering middleware defaults ( @amazon7737)

fixFix grammar in TLS, TCP service, and routing reference docs ( @almightymoon)

fixFix X-Forwarded-Prefix documentation for dashboard redirection ( @kevinpollet)

3.7.6 Jun 30, 2026 Release notes ↗

securityCVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5)

securityCVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m)

securityCVE-2026-54765 (Advisory GHSA-6p8f-p8j2-rqmv)

fix[acme, logs] Bump github.com/go-acme/lego/v5 ( @ldez)

fix[acme] Bump github.com/go-acme/lego/v5 ( @juliens)

fix[k8s, k8s/ingress-nginx] Fix ingress-nginx ssl passthrough status updates ( @nickmnt)

fix[k8s/gatewayapi] Add missing Gateway API features in conformance tests ( @AnatoleLucet)

fix[k8s/gatewayapi] Avoid collisions for Gateway API services names ( @rtribotte)

fix[k8s/gatewayapi] Ignore other gateways parentRefs and update route parent statuses only for managed gateways ( @rtribotte)

fix[k8s/ingress-nginx] Configure retry according to buffering configuration ( @rtribotte)

fix[k8s/ingress-nginx] Fix force-ssl-redirect routing 418 when TLS is terminated upstream ( @carloslima)

fix[k8s] Detect EndpointSlice condition changes ( @kevinpollet)

fix[k8s] Index Kubernetes EndpointSlice by service name ( @kevinpollet)

fix[k8s] Sort endpointslices to keep backend IPs consistent across rebuilds ( @kevinpollet)

fix[kv] Bump kvtools/redis to v1.2.1 ( @ldez)

fix[middleware, authentication] Fix x-forwarded-port in forward-auth ( @juliens)

fix[middleware, k8s/gatewayapi] Fix Gateway API redirect missing statuses ( @AnatoleLucet)

fix[middleware, k8s/gatewayapi] Fix Host header not being modified by RequestHeaderModifier ( @mihuross)

fix[middleware, k8s/gatewayapi] Fix request scheme derivation when Gateway API RequestRedirect omits scheme ( @gndz07)

fix[middleware] Fix CORS Max-Age set to 0 by default ( @AnatoleLucet)

fix[middleware] Fix CORS wildcard when allow-credentials is true ( @AnatoleLucet)

fix[server] Add an option to remove request headers with underscores ( @youkoulayley)

fix[server] Configurable max request header size ( @juliens)

fix[tls] Fix nondeterministic TLS certificate selection on shared SAN ( @rtribotte)

fix[webui] Bump axios to v1.18.0 ( @gndz07)

fix[websocket] Fix connection upgrades when backend server is using h2c scheme ( @stffabi)

other[k8s/crd] Fix broken CRD reference links in IngressRoute page ( @s3onghyun)

other[k8s/gatewayapi] Remove experimental note for Gateway API/TLSRoute documentation ( @jnoordsij)

feature[k8s/ingress-nginx] Add Kubernetes Ingress NGINX to the providers list ( @nmengin)

other[k8s] Align Helm chart documented values with chart v41 ( @mloiseleur)

other[middleware, authentication, k8s/ingress-nginx] Clarify intentional auth-response-headers gating and absence of stripping incoming X-Forwarded-* headers ( @rtribotte)

other[middleware] Clarify entryPoint middleware reference format ( @mloiseleur)

security[security] Add HTTP/2 header memory exhaustion security documentation ( @emilevauge)

featureAdds documentations on maxHeaderBytes ( @juliens)

fixFix inaccuracies in reference documentation ( @sheddy-traefik)

3.7.5 Jun 10, 2026 Release notes ↗

securityCVE-2026-54761 (Advisory GHSA-3g6v-2r68-prfc)

securityCVE-2026-54762 (Advisory GHSA-4mr2-fg2p-w63c)

fix[k8s/ingress-nginx] Skip ingress when auth-secret resolution fails ( @gndz07)

fix[k8s/ingress-nginx] Pass endpointslice fencing on ingress-nginx provider ( @Learloj)

fix[k8s/gatewayapi] Reject cross-provider references with backendRefs.namespace ( @youkoulayley)

fix[server] Bump to github.com/pires/go-proxyproto v0.12.0 ( @timschumi)

fix[tls] Fix routers with same host, different tlsoptions on different entryPoint ( @juliens)

fix[tls] Fix snicheck for routers with no hosts ( @rtribotte)

3.7.4 Jun 5, 2026 Release notes ↗

fix[middleware] Fix redis write timeout option configuration ( @bzyy1024)

fix[webui] Bump react-router and jsdom ( @gndz07)

fix[k8s/gatewayapi] Fix BackendTLSPolicy status update ( @AnatoleLucet)

fix[http3] Bump github.com/quic-go/quic-go to v0.59.1 ( @rtribotte)

fix[webui] Bump axios to v1.17.0 ( @gndz07)

fix[tls] Fix snicheck with keepalive ( @juliens)

3.7.3 Jun 4, 2026 Release notes ↗

securityCVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2)

securityCVE-2026-48491 (Advisory GHSA-5r4w-85f3-pw66)

securityCVE-2026-53622 (Advisory GHSA-9cr8-q42q-g8m7)

fix[tls] Compute resolved tlsOptions after applying models ( @rtribotte)

fix[webui, tcp] Fix TCP router service resolution in dashboard flow diagram ( @aliamerj)

fix[k8s/ingress-nginx] Trim quotes from proxy_set_header header name ( @crisbal)

fix[accesslogs] Escape double quotes in quoted log fields ( @KaanSimsek)

fix[k8s/gatewayapi] Escape exact gRPC method matches ( @nickmnt)

fix[logs, middleware] Allow query parameters to be dropped from RequestPath in access log ( @calinelson)

fix[k8s/ingress-nginx] Clear Ssl-Client-* headers when no client certificate is present ( @gndz07)

fix[k8s/gatewayapi] Bump github.com/moby/spdystream to v0.5.1 ( @kevinpollet)

fix[file] Improve file provider behavior regarding dangling symlinks ( @fh-yuxiao-zeng)

fix[server] Bump github.com/bytedance/sonic to v1.15.1 ( @kevinpollet)

fix[middleware, authentication] Add error on basic auth build if users is empty ( @rtribotte)

fix[k8s/ingress] Avoid ingress path matcher injection and backport 11d251415 ( @rtribotte)

fix[server] Move snicheck to ctx instead of simulated routing ( @juliens)

fix[middleware] Reject requests with different paths after StripPrefix and StripPrefixRegex normalisation ( @rtribotte)

fix[server] Bump golang.org/x/net to v0.55.0 ( @kevinpollet)

fix[k8s/gatewayapi] Change default values and expose configuration for Kubernetes client QPS and Burst ( @kevinpollet)

fix[server] Bump golang.org/x/crypto to v0.52.0 ( @rtribotte)

feature[k8s] Document new chart behavior on Gateway API ( @mloiseleur)

other[file] Replace generated File routing reference page ( @sheddy-traefik)

other[k8s/crd] Fix typo in accesslogs field name ( @PlayMTL)

other[k8s/ingress-nginx] Surface the Ingress status race condition during NGINX coexistence ( @emilevauge)

otherPolish grammar in migration guides ( @quyentonndbs)

other[middleware] Remove whitespace in HTML tag ( @marbon87)

featureAdd @LBF38 as a current maintainer ( @emilevauge)

featureAdd ingressClassName to Kubernetes CRD provider migration guide ( @kevinpollet)

feature[k8s/ingress-nginx] Add nginx.ingress.kubernetes.io/enable-global-auth to the list of supported annotations ( @filip2mac)

other[k8s/ingress-nginx] Capitalize NGINX in kubernetesIngressNGINX ( @smellems)

3.7.1 May 11, 2026 Release notes ↗

securityCVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc)

securityAdvisory GHSA-rh7m-2m44-x32f

fix[k8s/ingress, k8s/crd, k8s/gatewayapi] Add CrossProviderNamespaces option ( @rtribotte)

fix[k8s/crd] Fix cross-provider ref check for Kubernetes CRD provider ( @rtribotte)

3.7.0 May 5, 2026 Release notes ↗

feature[k8s/ingress-nginx] Use a metamodel to generate dynamic configuration in ingress-nginx ( @juliens)

feature[k8s/ingress-nginx] Add limit-connections support ( @amazon7737)

feature[webui] Display server weight in service detail view ( @murataslan1)

feature[webui, tls] Add certificates menu and overview ( @holomekc)

feature[provider] Add providers routing precedence configuration ( @juliens)

feature[k8s/ingress-nginx] Support NGINX global auth annotation ( @foxcool)

feature[k8s/ingress-nginx] Add limit-burst-multiplier annotation support ( @amazon7737)

feature[k8s/ingress-nginx, k8s/ingress, rules] Add wildcard host in Host and HostSNI matchers ( @juliens)

feature[k8s/gatewayapi] Support multiple certificateRefs on gateway listeners ( @mortennordbye)

feature[k8s/gatewayapi] Add secret support for BackendTLSPolicy caCertificateRefs ( @kevinpollet)

feature[accesslogs, k8s/ingress-nginx] Support nginx.ingress.kubernetes.io/enable-access-log annotation ( @ris-tlp)

feature[accesslogs, k8s/ingress-nginx, k8s/ingress] Add Kubernetes Ingress logs fields ( @rtribotte)

feature[k8s/knative] Support knative v1.20.0 ( @idurgakalyan)

feature[k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.5.1 ( @mmatur)

feature[k8s/ingress-nginx, middleware, authentication] Add support for auth-snippet ( @juliens)

feature[accesslogs, otel] Allow Stdio access logs alongsige OTLP logging ( @Mulgish)

feature[acme] Add CertificateTimeout ACME configuration option ( @ceko)

feature[k8s/ingress-nginx] Support nginx.ingress.kubernetes.io/allowlist-source-range ( @ris-tlp)

feature[k8s/crd] Add ingressClassName field to the CRDs spec ( @kkrypt0nn)

feature[k8s/crd] Service failover support in TraefikService CRD ( @jspdown)

feature[k8s/crd, service] Support cipher suites configuration with ServersTransport ( @NEwa-05)

feature[k8s/ingress, middleware, k8s/crd, service, k8s/gatewayapi] Services middleware and Gateway API filters on HTTP backends ( @juliens)

feature[k8s/ingress-nginx] Add nginx.ingress.kubernetes.io/proxy-connect-timeout annotation ( @gndz07)

feature[k8s/ingress-nginx] Add rewrite-target nginx annotations support ( @LBF38)

feature[k8s/ingress-nginx] Add support for app-root nginx annotation ( @LBF38)

feature[k8s/ingress-nginx] Add support for auth-signin annotation ( @DesalLama)

feature[k8s/ingress-nginx] Add support for from-to-www-redirect NGINX annotation ( @LBF38)

feature[k8s/ingress-nginx] Add support for proxy-read-timeout and proxy-send-timeout NGINX annotations ( @LBF38)

securityUpdate vulnerability submission guidelines ( @emilevauge)

security[k8s] Improve the multi tenant security note ( @nmengin)

securityAdd vulnerability submission quality guidelines ( @emilevauge)

breakingRemove unsupported servers[n].address from TCP label examples ( @sheddy-traefik)

security[k8s] Improve the K8S multi-tenancy security note ( @nmengin)

breakingAdd a Breaking change note to the changelog ( @nmengin)

securityBring back security section on API & Dashboard documentation page ( @gndz07)

deprecatedFix migration guide URLs in deprecation notice ( @alexmar07)

breakingRemove extra dots in migration guide ( @rtribotte)

breakingRemove extraneous dots in migration guide ( @dathbe)

securityUpdate SECURITY.md ( @cwayne18)

securityUpdate SECURITY.md to streamline information ( @emilevauge)

+242 more items in the release notes

3.6.25 Jul 31, 2026 Release notes ↗