VDB
CVE-2026-35051
CVE-2026-35051
PUBLISHED
CVSS 7.800000190734863 HIGH
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is an authentication bypass vulnerability in Traefik's ForwardAuth middleware when trustForwardHeader=false is configured and Traefik is deployed behind a trusted upstream proxy. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.
EPSS 0.03% · 7.4th percentile
Risk Scores
CVSS v4.0
7.800000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N
EPSS Score
0.03%
7.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| traefik | traefik | >= 3.0.0-beta1, < 3.6.14, *, * |
Timeline
- Apr 24, 2026 CVE Published
- Apr 24, 2026 PoC Published
- May 1, 2026 Security Advisory
- May 6, 2026 CVE Updated
- May 18, 2026 EPSS Score
- May 19, 2026 EPSS Score
- May 20, 2026 EPSS Score
- May 21, 2026 EPSS Score
- May 22, 2026 EPSS Score
- May 23, 2026 EPSS Score
- May 24, 2026 EPSS Score
- May 25, 2026 EPSS Score
References
- https://github.com/traefik/traefik/security/advisories/GHSA-6jwx-7vp4-9847 advisory
- https://github.com/traefik/traefik/security/advisories/GHSA-6x2q-h3cr-8j2h advisory
- https://github.com/traefik/traefik/security/advisories/GHSA-5m6w-wvh7-57vm advisory
- https://github.com/traefik/traefik/security/advisories/GHSA-xhjw-95fp-8vgq advisory
- https://github.com/traefik/traefik/security/advisories/GHSA-6384-m2mw-rf54 advisory
- https://github.com/traefik/traefik/releases/tag/v2.11.43 url
- https://github.com/traefik/traefik/releases/tag/v3.6.14 url
- https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2 url