PT-2026-36177 · Traefik · Traefik

Zwique · Published 2026-04-22 · Updated 2026-06-05 · CVE-2026-35051

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 2.11.43 Traefik versions prior to 3.6.14 Traefik versions prior to 3.7.0-rc.2

Description An authentication bypass exists in the ForwardAuth middleware of Traefik, an HTTP reverse proxy and load balancer. This occurs when trustForwardHeader is set to false and the software is deployed behind a trusted upstream proxy.

Recommendations Update to version 2.11.43. Update to version 3.6.14. Update to version 3.7.0-rc.2.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

BDU:2026-06479

CVE-2026-35051

GHSA-6384-M2MW-RF54

OPENSUSE-SU-2026:10697-1

OPENSUSE-SU-2026:10698-1

Affected Products

Traefik

References · 22

• https://github.com/traefik/traefik/security/advisories/GHSA-6384-m2mw-rf54 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10698-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10697-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6384-m2mw-rf54 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06479 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-35051 · Security Note
• https://github.com/traefik/traefik · Note
• https://github.com/traefik/traefik/releases/tag/v2.11.43 · Note
• https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2 · Note
• https://github.com/traefik/traefik/releases/tag/v3.6.14 · Note
• https://suse.com/security/cve/CVE-2026-35051 · Note
• https://suse.com/security/cve/CVE-2026-40912 · Note
• https://suse.com/security/cve/CVE-2026-41263 · Note
• https://suse.com/security/cve/CVE-2026-39858 · Note
• https://t.me/cyberok_news/222 · Telegram Post