Is Traefik 3.6.19 affected?

Vulnerabilities affecting 3.6.19

• 9.3
  GHSA-5w68-77r2-r64c Complete authentication bypass in the `digestAuth` middleware
• 9.1
  CVE-2026-88007 Traefik HTTP/3 Backend NTLM Connection Reuse
• 8.8
  CVE-2026-88009 Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
• 8.2
  GHSA-ww7c-q3mv-xx22 Data race on the shared bufio.Reader after an HTTP/1 upgrade in FastProxy panics the whole process
• 8.2
  GHSA-g55h-rg46-x9c5 TLS option confusion in multi-host routers can bypass mTLS for protected hosts
• 7.8
  GHSA-cxjq-mrr5-89rv Authentication Bypass via Path Traversal in ReplacePathRegex Middleware
• 7.6
  CVE-2026-71327 Gateway API route identity collision allows cross-namespace backend hijacking
• 7.0
  GHSA-hrpp-p4fc-wwf8 ForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity across clients
• 7.0
  GHSA-53qr-784g-cj35 FastProxy backend connection pool leaks connection-bound NTLM/Negotiate identity to unauthenticated clients
• 7.0
  GHSA-cw35-4q88-3rmp Connection-scoped NTLM/Kerberos sticky round tripper is not keyed by service, applying one service TLS client config to another
• 7.0
  GHSA-qm9f-w54v-q2qh Preauthenticated Negotiate contaminates Traefik's globally shared backend connection pool
• 7.0
  GHSA-fh26-gfpp-7xxx snicheck skips the check when `req.TLS` is nil (HTTP/2 `:scheme http`)
• 7.0
  CVE-2026-88004 Traefik entrypoint header-name sanitization bypassed via request trailers
• 7.0
  CVE-2026-88008 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization in github.com/traefik/traefik/v3
• 7.0
  CVE-2026-71324 Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool
• 6.9
  GHSA-2272-4vv8-65ww Negated Host matcher causes a TLS option conflict that disables client-certificate authentication on the excluded host
• 6.9
  CVE-2026-54764 ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false
• 6.3
  GHSA-mhjw-hmjv-p99x Unsynchronized write to the per-connection sticky round tripper shared by concurrent HTTP/2 streams
• 6.3
  CVE-2026-88010 BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle
• 6.0
  CVE-2026-54761 Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services
• 5.3
  CVE-2026-88012 respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded
• 5.3
  CVE-2026-88011 ForwardAuth identity spoofing via dot-form header alias
• 5.3
  CVE-2026-65602 Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass
• 4.8
  CVE-2026-71325 `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef
• 2.1
  CVE-2026-71326 BasicAuth singleflight key collision allows authenticated identity spoofing
• high
  CVE-2026-54763 Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth

Newer releases