Traefik 3.7.7 → 3.7.16

Vulnerabilities fixed by this upgrade

• 7.0 GHSA-hrpp-p4fc-wwf8 ForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity across clients
• 8.2 GHSA-ww7c-q3mv-xx22 Data race on the shared bufio.Reader after an HTTP/1 upgrade in FastProxy panics the whole process
• 7.0 GHSA-p8wx-ph99-xgcr ingress-nginx provider: mTLS (auth-tls-secret) silently disabled for a host when another Ingress on the same host has no matching auth-tls annotation
• 6.3 GHSA-mhjw-hmjv-p99x Unsynchronized write to the per-connection sticky round tripper shared by concurrent HTTP/2 streams
• 6.9 GHSA-2272-4vv8-65ww Negated Host matcher causes a TLS option conflict that disables client-certificate authentication on the excluded host
• 7.0 GHSA-rv2h-qh7j-xrjw Ingress-NGINX provider: colliding auth-tls-secret names merge two client CAs into one TLS option, so a host is gated by another host's CA
• 7.0 GHSA-mwrr-6hp4-pxr6 Ingress-NGINX provider forwards forged Ssl-Client-* identity headers on its HTTP route
• 7.0 GHSA-53qr-784g-cj35 FastProxy backend connection pool leaks connection-bound NTLM/Negotiate identity to unauthenticated clients
• 7.0 GHSA-cw35-4q88-3rmp Connection-scoped NTLM/Kerberos sticky round tripper is not keyed by service, applying one service TLS client config to another
• 7.0 GHSA-qm9f-w54v-q2qh Preauthenticated Negotiate contaminates Traefik's globally shared backend connection pool
• 7.0 GHSA-fh26-gfpp-7xxx snicheck skips the check when `req.TLS` is nil (HTTP/2 `:scheme http`)
• 6.3 CVE-2026-88010 BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle
• 7.0 CVE-2026-88004 Traefik entrypoint header-name sanitization bypassed via request trailers
• 7.0 CVE-2026-88008 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization in github.com/traefik/traefik/v3
• 9.1 CVE-2026-88007 Traefik HTTP/3 Backend NTLM Connection Reuse
• 8.8 CVE-2026-88009 Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
• high GHSA-cjr6-pf59-jq29 ingress-nginx from-to-www-redirect sibling router serves the auth-protected backend without auth
• 5.3 CVE-2026-88012 respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded
• 5.3 CVE-2026-88011 ForwardAuth identity spoofing via dot-form header alias
• 8.2 GHSA-j994-9gqj-9hwq Same-host Ingress TLS option conflict disables client-certificate authentication
• 7.0 GHSA-m6wx-622r-48r9 Kubernetes Ingress service middleware bypasses crossProviderNamespaces
• 8.2 GHSA-g55h-rg46-x9c5 TLS option confusion in multi-host routers can bypass mTLS for protected hosts
• 9.3 GHSA-5w68-77r2-r64c Complete authentication bypass in the `digestAuth` middleware
• 2.1 CVE-2026-71326 BasicAuth singleflight key collision allows authenticated identity spoofing
• 4.8 CVE-2026-71325 `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef
• 7.6 CVE-2026-71327 Gateway API route identity collision allows cross-namespace backend hijacking
• 7.0 CVE-2026-71324 Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool
• 7.8 GHSA-8rxv-jg7p-wvg3 Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass

Breaking changes

• breaking Remove redundant period in README ( @mxmrnn) in 3.7.15
• breaking Remove retired Go Report Card badge ( @yardenshoham) in 3.7.11

Security changes

• security [security] Fix typo in the Request Path page ( @SethFalco) in 3.7.15
• security [security] Document the coordinated disclosure embargo for security reports ( @emilevauge) in 3.7.14
• security Advisory GHSA-qqjf-53cj-pwvv in 3.7.13
• security Advisory GHSA-f52w-8j3h-j724 in 3.7.13
• security Advisory GHSA-v67p-phpq-fc8x in 3.7.13
• security Advisory GHSA-w4v4-9rw7-5326 in 3.7.13
• security Advisory GHSA-8fcf-v89g-xpg6 in 3.7.13
• security Tell scanning agents to read the security policy and decisions pages ( @emilevauge) in 3.7.13
• security Advisory GHSA-cjr6-pf59-jq29 in 3.7.12
• security Advisory GHSA-7ghq-v6jf-g56c in 3.7.12
• security Advisory GHSA-rf44-j88r-hh8c in 3.7.12
• security [security] Document the security threat model and settled security decisions ( @emilevauge) in 3.7.12
• security Reduce SECURITY.md to a pointer to the security documentation ( @emilevauge) in 3.7.12
• security Advisory GHSA-5w68-77r2-r64c in 3.7.11
• security Advisory GHSA-g55h-rg46-x9c5 in 3.7.11
• security Advisory GHSA-j994-9gqj-9hwq in 3.7.11
• security Advisory GHSA-m6wx-622r-48r9 in 3.7.11
• security Advisory GHSA-fgjj-px3w-67xx in 3.7.10
• security Advisory GHSA-62fc-8686-hfmq in 3.7.10
• security Advisory GHSA-6765-c87h-8mrf in 3.7.10
• security Advisory GHSA-3ccp-42pg-hgv6 in 3.7.9
• security Advisory GHSA-8rxv-jg7p-wvg3 in 3.7.8

Every release in between