PT-2026-29940 · Go · Github.Com/Traefik/Traefik+2

Published 2026-04-02 · Updated 2026-04-02

OSV

Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField in github.com/traefik/traefik

Related Identifiers

GO-2026-4893

Affected Products

Github.Com/Traefik/Traefik

Github.Com/Traefik/Traefik/V2

Github.Com/Traefik/Traefik/V3

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-33433 · Security Note
• https://osv.dev/vulnerability/GO-2026-4893 · Vendor Advisory
• https://github.com/traefik/traefik/security/advisories/GHSA-qr99-7898-vr7c · Note
• https://github.com/traefik/traefik/releases/tag/v3.6.11 · Note
• https://github.com/traefik/traefik/releases/tag/v2.11.42 · Note
• https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.3 · Note