Traefik 3.6.12 → 3.7.3

15 releases · 4 breaking changes · 32 security fixes · 10 advisories fixed

32security4breaking1deprecated41feature112fix

Is 3.6.12 affected? · What changed up to 3.7.16

Vulnerabilities fixed by this upgrade

6.4 GHSA-rh7m-2m44-x32f Traefik: Kubernetes Ingress and Service annotations allow cross-namespace references to Middlewares, ServersTransports, and TLSOptions
7.8 CVE-2026-53622 HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts
7.8 CVE-2026-48020 Traefik StripPrefix Route-Level Auth Bypass via Path Normalization
6.4 CVE-2026-44774 Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false
6.9 CVE-2026-41181 Errors middleware forwards Authorization and Cookie headers to separate error page service
7.8 CVE-2026-40912 StripPrefixRegex auth bypass via Path/RawPath desync
7.8 CVE-2026-35051 ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth
7.8 CVE-2026-39858 Forwarded alias spoofing top pre-auth decision bypass
6.3 CVE-2026-41263 BasicAuth middleware: timing side-channel vulnerability
4.8 CVE-2026-41174 Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding

Breaking changes

breaking Remove unsupported servers[n].address from TCP label examples ( @sheddy-traefik) in 3.7.0
breaking Add a Breaking change note to the changelog ( @nmengin) in 3.7.0
breaking Remove extra dots in migration guide ( @rtribotte) in 3.7.0
breaking Remove extraneous dots in migration guide ( @dathbe) in 3.7.0

Security changes

security CVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2) in 3.7.3
security CVE-2026-48491 (Advisory GHSA-5r4w-85f3-pw66) in 3.7.3
security CVE-2026-53622 (Advisory GHSA-9cr8-q42q-g8m7) in 3.7.3
security CVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc) in 3.7.1
security Advisory GHSA-rh7m-2m44-x32f in 3.7.1
security Update vulnerability submission guidelines ( @emilevauge) in 3.7.0
security [k8s] Improve the multi tenant security note ( @nmengin) in 3.7.0
security Add vulnerability submission quality guidelines ( @emilevauge) in 3.7.0
security [k8s] Improve the K8S multi-tenancy security note ( @nmengin) in 3.7.0
security Bring back security section on API & Dashboard documentation page ( @gndz07) in 3.7.0
security Update SECURITY.md ( @cwayne18) in 3.7.0
security Update SECURITY.md to streamline information ( @emilevauge) in 3.7.0
security Advisory GHSA-fgjj-px3w-67xx in 3.6.25
security Advisory GHSA-62fc-8686-hfmq in 3.6.25
security Advisory GHSA-6765-c87h-8mrf in 3.6.25
security Advisory GHSA-3ccp-42pg-hgv6 in 3.6.24
security Advisory GHSA-cxjq-mrr5-89rv in 3.6.23
security Advisory GHSA-42cj-m3vj-89wv in 3.6.23
security CVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5) in 3.6.22
security CVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m) in 3.6.22
security [security] Add HTTP/2 header memory exhaustion security documentation ( @emilevauge) in 3.6.22
security CVE-2026-54761 (Advisory GHSA-3g6v-2r68-prfc) in 3.6.21
security CVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2) in 3.6.19
security CVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc) in 3.6.17
security Advisory GHSA-rh7m-2m44-x32f in 3.6.17
security CVE-2026-41181 (Advisory GHSA-p6hg-qh38-555r) in 3.6.15
security CVE-2026-40912 (Advisory GHSA-6jwx-7vp4-9847) in 3.6.14
security CVE-2026-39858 (Advisory GHSA-5m6w-wvh7-57vm) in 3.6.14
security CVE-2026-35051 (Advisory GHSA-6384-m2mw-rf54) in 3.6.14
security CVE-2026-41263 (Advisory GHSA-6x2q-h3cr-8j2h) in 3.6.14
security CVE-2026-41174 (Advisory GHSA-xhjw-95fp-8vgq) in 3.6.14
security Update vulnerability submission guidelines ( @emilevauge) in 3.6.14

Deprecations

deprecated Fix migration guide URLs in deprecation notice ( @alexmar07) in 3.7.0

Every release in between

3.7.3 Jun 4, 2026 Release notes ↗

securityCVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2)

securityCVE-2026-48491 (Advisory GHSA-5r4w-85f3-pw66)

securityCVE-2026-53622 (Advisory GHSA-9cr8-q42q-g8m7)

fix[tls] Compute resolved tlsOptions after applying models ( @rtribotte)

fix[webui, tcp] Fix TCP router service resolution in dashboard flow diagram ( @aliamerj)

fix[k8s/ingress-nginx] Trim quotes from proxy_set_header header name ( @crisbal)

fix[accesslogs] Escape double quotes in quoted log fields ( @KaanSimsek)

fix[k8s/gatewayapi] Escape exact gRPC method matches ( @nickmnt)

fix[logs, middleware] Allow query parameters to be dropped from RequestPath in access log ( @calinelson)

fix[k8s/ingress-nginx] Clear Ssl-Client-* headers when no client certificate is present ( @gndz07)

fix[k8s/gatewayapi] Bump github.com/moby/spdystream to v0.5.1 ( @kevinpollet)

fix[file] Improve file provider behavior regarding dangling symlinks ( @fh-yuxiao-zeng)

fix[server] Bump github.com/bytedance/sonic to v1.15.1 ( @kevinpollet)

fix[middleware, authentication] Add error on basic auth build if users is empty ( @rtribotte)

fix[k8s/ingress] Avoid ingress path matcher injection and backport 11d251415 ( @rtribotte)

fix[server] Move snicheck to ctx instead of simulated routing ( @juliens)

fix[middleware] Reject requests with different paths after StripPrefix and StripPrefixRegex normalisation ( @rtribotte)

fix[server] Bump golang.org/x/net to v0.55.0 ( @kevinpollet)

fix[k8s/gatewayapi] Change default values and expose configuration for Kubernetes client QPS and Burst ( @kevinpollet)

fix[server] Bump golang.org/x/crypto to v0.52.0 ( @rtribotte)

feature[k8s] Document new chart behavior on Gateway API ( @mloiseleur)

other[file] Replace generated File routing reference page ( @sheddy-traefik)

other[k8s/crd] Fix typo in accesslogs field name ( @PlayMTL)

other[k8s/ingress-nginx] Surface the Ingress status race condition during NGINX coexistence ( @emilevauge)

otherPolish grammar in migration guides ( @quyentonndbs)

other[middleware] Remove whitespace in HTML tag ( @marbon87)

featureAdd @LBF38 as a current maintainer ( @emilevauge)

featureAdd ingressClassName to Kubernetes CRD provider migration guide ( @kevinpollet)

feature[k8s/ingress-nginx] Add nginx.ingress.kubernetes.io/enable-global-auth to the list of supported annotations ( @filip2mac)

other[k8s/ingress-nginx] Capitalize NGINX in kubernetesIngressNGINX ( @smellems)

3.7.1 May 11, 2026 Release notes ↗

securityCVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc)

securityAdvisory GHSA-rh7m-2m44-x32f

fix[k8s/ingress, k8s/crd, k8s/gatewayapi] Add CrossProviderNamespaces option ( @rtribotte)

fix[k8s/crd] Fix cross-provider ref check for Kubernetes CRD provider ( @rtribotte)

3.7.0 May 5, 2026 Release notes ↗

feature[k8s/ingress-nginx] Use a metamodel to generate dynamic configuration in ingress-nginx ( @juliens)

feature[k8s/ingress-nginx] Add limit-connections support ( @amazon7737)

feature[webui] Display server weight in service detail view ( @murataslan1)

feature[webui, tls] Add certificates menu and overview ( @holomekc)

feature[provider] Add providers routing precedence configuration ( @juliens)

feature[k8s/ingress-nginx] Support NGINX global auth annotation ( @foxcool)

feature[k8s/ingress-nginx] Add limit-burst-multiplier annotation support ( @amazon7737)

feature[k8s/ingress-nginx, k8s/ingress, rules] Add wildcard host in Host and HostSNI matchers ( @juliens)

feature[k8s/gatewayapi] Support multiple certificateRefs on gateway listeners ( @mortennordbye)

feature[k8s/gatewayapi] Add secret support for BackendTLSPolicy caCertificateRefs ( @kevinpollet)

feature[accesslogs, k8s/ingress-nginx] Support nginx.ingress.kubernetes.io/enable-access-log annotation ( @ris-tlp)

feature[accesslogs, k8s/ingress-nginx, k8s/ingress] Add Kubernetes Ingress logs fields ( @rtribotte)

feature[k8s/knative] Support knative v1.20.0 ( @idurgakalyan)

feature[k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.5.1 ( @mmatur)

feature[k8s/ingress-nginx, middleware, authentication] Add support for auth-snippet ( @juliens)

feature[accesslogs, otel] Allow Stdio access logs alongsige OTLP logging ( @Mulgish)

feature[acme] Add CertificateTimeout ACME configuration option ( @ceko)

feature[k8s/ingress-nginx] Support nginx.ingress.kubernetes.io/allowlist-source-range ( @ris-tlp)

feature[k8s/crd] Add ingressClassName field to the CRDs spec ( @kkrypt0nn)

feature[k8s/crd] Service failover support in TraefikService CRD ( @jspdown)

feature[k8s/crd, service] Support cipher suites configuration with ServersTransport ( @NEwa-05)

feature[k8s/ingress, middleware, k8s/crd, service, k8s/gatewayapi] Services middleware and Gateway API filters on HTTP backends ( @juliens)

feature[k8s/ingress-nginx] Add nginx.ingress.kubernetes.io/proxy-connect-timeout annotation ( @gndz07)

feature[k8s/ingress-nginx] Add rewrite-target nginx annotations support ( @LBF38)

feature[k8s/ingress-nginx] Add support for app-root nginx annotation ( @LBF38)

feature[k8s/ingress-nginx] Add support for auth-signin annotation ( @DesalLama)

feature[k8s/ingress-nginx] Add support for from-to-www-redirect NGINX annotation ( @LBF38)

feature[k8s/ingress-nginx] Add support for proxy-read-timeout and proxy-send-timeout NGINX annotations ( @LBF38)

securityUpdate vulnerability submission guidelines ( @emilevauge)

security[k8s] Improve the multi tenant security note ( @nmengin)

securityAdd vulnerability submission quality guidelines ( @emilevauge)

breakingRemove unsupported servers[n].address from TCP label examples ( @sheddy-traefik)

security[k8s] Improve the K8S multi-tenancy security note ( @nmengin)

breakingAdd a Breaking change note to the changelog ( @nmengin)

securityBring back security section on API & Dashboard documentation page ( @gndz07)

deprecatedFix migration guide URLs in deprecation notice ( @alexmar07)

breakingRemove extra dots in migration guide ( @rtribotte)

breakingRemove extraneous dots in migration guide ( @dathbe)

securityUpdate SECURITY.md ( @cwayne18)

securityUpdate SECURITY.md to streamline information ( @emilevauge)

+242 more items in the release notes

3.6.25 Jul 31, 2026 Release notes ↗

securityAdvisory GHSA-fgjj-px3w-67xx

securityAdvisory GHSA-62fc-8686-hfmq

securityAdvisory GHSA-6765-c87h-8mrf

fix[acme] Bump github.com/go-acme/lego/v5 to v5.3.1 ( @ldez)

fix[middleware, authentication] Fix auth singleflight key collision ( @mmatur)

fix[k8s/gatewayapi] Avoid router name collisions in Kubernetes Gateway API provider ( @gndz07)

fix[tracing] Bump github.com/DataDog/dd-trace-go/v2 to 2.8.1 ( @kevinpollet)

fixBump golang.org/x/text to v0.40.0 and golang.org/x/net v0.57.0 ( @mmatur)

fix[k8s/crd] Fix cross-namespace service reference check in Kubernetes CRD provider ( @gndz07)

fix[middleware] Bump github.com/klauspost/compress to v1.18.7 ( @mmatur)

3.6.24 Jul 24, 2026 Release notes ↗

securityAdvisory GHSA-3ccp-42pg-hgv6

fix[middleware, k8s/crd] Add missing ErrorRequestHeaders field to CRDs ( @kevinpollet)

fix[logs] Remove unrelated error from nonexistent cert resolver log ( @ArthurHlt)

fix[middleware] Disable Zstd support in the gzhttp wrapper ( @kevinpollet)

fix[server] Defer the CONNECT payload until the backend accepts the tunnel ( @sdelicata)

fix[server] Discard CONNECT body in forwardauth and reject CONNECT requests with fast proxy ( @sdelicata)

fix[server] Bump google.golang.org/grpc to v1.82.1 ( @piscue)

fix[server] Do not add back CONNECT requests to the pool ( @kevinpollet)

other[k8s] Align certificateRef and indicate ports ( @veenoise)

other[rules] Fix syntax notes in routing rule documentation ( @stevenlele)

featureAdd a migration note for CONNECT requests ( @kevinpollet)

3.6.23 Jul 8, 2026 Release notes ↗

securityAdvisory GHSA-cxjq-mrr5-89rv

securityAdvisory GHSA-42cj-m3vj-89wv

fix[acme] Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 ( @rtribotte)

fix[k8s] Fix panic when endpointslice port value or name is nil ( @kevinpollet)

fix[k8s/crd] Fix cross-provider ref check for TCP ServersTransport in Kubernetes CRD provider ( @gndz07)

fix[middleware] Fix handle empty unknown-length bodies in mirroring ( @amazon7737)

fix[middleware] Sanitize replaced path in ReplacePathRegex middleware ( @kevinpollet)

fix[otel] Bump go.opentelemetry.io/otel to v1.44.0 ( @rtribotte)

other[middleware] Clarify buffering middleware defaults ( @amazon7737)

featureAdd @amazon7737 as a current maintainer ( @emilevauge)

featureAdd @nandorKollar as a current maintainer ( @emilevauge)

fixFix changelog v2.11.51 ( @mmatur)

fixFix grammar in TLS, TCP service, and routing reference docs ( @almightymoon)

fixFix some function names in comments ( @blackflytech)

fixFix version in migration guide ( @kevinpollet)

fixFix X-Forwarded-Prefix documentation for dashboard redirection ( @kevinpollet)

3.6.22 Jun 30, 2026 Release notes ↗

securityCVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5)

securityCVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m)

fix[acme, logs] Bump github.com/go-acme/lego/v5 ( @ldez)

fix[acme] Bump github.com/go-acme/lego/v5 ( @juliens)

fix[k8s/gatewayapi] Add missing Gateway API features in conformance tests ( @AnatoleLucet)

fix[k8s/gatewayapi] Ignore other gateways parentRefs and update route parent statuses only for managed gateways ( @rtribotte)

fix[k8s] Detect EndpointSlice condition changes ( @kevinpollet)

fix[k8s] Index Kubernetes EndpointSlice by service name ( @kevinpollet)

fix[k8s] Sort endpointslices to keep backend IPs consistent across rebuilds ( @kevinpollet)

fix[kv] Bump kvtools/redis to v1.2.1 ( @ldez)

fix[middleware, authentication] Fix x-forwarded-port in forward-auth ( @juliens)

fix[middleware, k8s/gatewayapi] Fix Host header not being modified by RequestHeaderModifier ( @mihuross)

fix[middleware, k8s/gatewayapi] Fix request scheme derivation when Gateway API RequestRedirect omits scheme ( @gndz07)

fix[middleware] Fix CORS Max-Age set to 0 by default ( @AnatoleLucet)

fix[middleware] Fix CORS wildcard when allow-credentials is true ( @AnatoleLucet)

fix[tls] Fix nondeterministic TLS certificate selection on shared SAN ( @rtribotte)

fix[server] Add an option to remove request headers with underscores ( @youkoulayley)

fix[server] Configurable max request header size ( @juliens)

fix[webui] Bump axios to v1.18.0 ( @gndz07)

fix[websocket] Fix connection upgrades when backend server is using h2c scheme ( @stffabi)

other[k8s] Align Helm chart documented values with chart v41 ( @mloiseleur)

other[k8s/crd] Fix broken CRD reference links in IngressRoute page ( @s3onghyun)

feature[k8s/ingress-nginx] Add Kubernetes Ingress NGINX to the providers list ( @nmengin)

other[middleware] Clarify entryPoint middleware reference format ( @mloiseleur)

security[security] Add HTTP/2 header memory exhaustion security documentation ( @emilevauge)

feature[server] Adds documentations on maxHeaderBytes ( @juliens)

fixFix inaccuracies in reference documentation ( @sheddy-traefik)

3.6.21 Jun 10, 2026 Release notes ↗

securityCVE-2026-54761 (Advisory GHSA-3g6v-2r68-prfc)

fix[k8s/gatewayapi] Reject cross-provider references with backendRefs.namespace ( @youkoulayley)

fix[server] Bump to github.com/pires/go-proxyproto v0.12.0 ( @timschumi)

fix[tls] Fix routers with same host, different tlsoptions on different entryPoint ( @juliens)

fix[tls] Fix snicheck for routers with no hosts ( @rtribotte)

3.6.20 Jun 5, 2026 Release notes ↗

fix[middleware] Fix redis write timeout option configuration ( @bzyy1024)

fix[webui] Bump react-router and jsdom ( @gndz07)

fix[k8s/gatewayapi] Fix BackendTLSPolicy status update ( @AnatoleLucet)

fix[http3] Bump github.com/quic-go/quic-go to v0.59.1 ( @rtribotte)

fix[webui] Bump axios to v1.17.0 ( @gndz07)

fix[tls] Fix snicheck with keepalive ( @juliens)

3.6.19 Jun 4, 2026 Release notes ↗