VDB
GO-2026-4897
GO-2026-4897
PUBLISHED
Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186) in github.com/traefik/traefik
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| github.com | traefik/traefik | 0 |
| github.com | traefik/traefik/v2 | 0 |
| github.com | traefik/traefik/v3 | 3.0.0-beta3, 3.7.0-ea.1 |
Timeline
- Apr 2, 2026 CVE Published
- Apr 7, 2026 CVE Updated
References
- https://github.com/traefik/traefik/security/advisories/GHSA-46wh-3698-f2cx advisory
- https://github.com/advisories/GHSA-p77j-4mvh-x3m3 url
- https://github.com/traefik/traefik/blob/67c64ed9b25fbb90f1086977a62827133a7aa01b/go.mod#L108 url
- https://github.com/traefik/traefik/releases/tag/v2.11.42 fix
- https://github.com/traefik/traefik/releases/tag/v3.6.12 fix
- https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.3 fix