Traefik
Traefik is a cloud-native reverse proxy and load balancer designed for microservices and container environments. It is widely used as a Kubernetes ingress controller and as the entry point for AI model serving endpoints. CVE history includes authentication middleware bypasses and header injection vulnerabilities.
Querying Traefik
traefik3.1.5, 2.11.8, 2.10.6curl "https://api.attestd.io/v1/check?product=traefik&version=2.5.0" \
-H "Authorization: Bearer $ATTESTD_KEY"Traefik 2.5.0 is affected by CVE-2022-23632 (TLS verification bypass in ForwardAuth middleware). The aggregated response expects risk_state: "high".
{
"product": "traefik",
"version": "2.5.0",
"supported": true,
"risk_state": "critical",
"risk_factors": [
"active_exploitation",
"remote_code_execution",
"no_authentication_required",
"internet_exposed_service",
"patch_available"
],
"actively_exploited": true,
"remote_exploitable": true,
"authentication_required": false,
"patch_available": true,
"fixed_version": null,
"confidence": 0.5,
"cve_ids": [
"CVE-2022-23469",
"CVE-2022-23632",
"CVE-2022-39271",
"CVE-2022-46153",
"CVE-2023-29013",
"CVE-2023-44487",
"CVE-2023-47106",
"CVE-2023-47124",
"CVE-2023-47633",
"CVE-2023-54365",
"CVE-2024-28869",
"CVE-2024-39321",
"CVE-2024-45410",
"CVE-2024-52003",
"CVE-2025-32431",
"CVE-2025-47952",
"CVE-2025-54386",
"CVE-2025-66490",
"CVE-2026-22045",
"CVE-2026-25949",
"CVE-2026-26998",
"CVE-2026-26999",
"CVE-2026-29777",
"CVE-2026-32305",
"CVE-2026-32595",
"CVE-2026-32695",
"CVE-2026-33433",
"CVE-2026-35051",
"CVE-2026-39858",
"CVE-2026-40912",
"CVE-2026-41174",
"CVE-2026-41181",
"CVE-2026-41263",
"CVE-2026-44774",
"CVE-2026-48020",
"CVE-2026-53622",
"CVE-2026-54761",
"CVE-2026-54763",
"CVE-2026-54764",
"CVE-2026-65600"
],
"cves": null,
"max_epss": 0.99999,
"last_updated": "2026-08-06T21:14:51.985946Z",
"supply_chain": null,
"supply_chain_monitored": false,
"typosquat": null
}Traefik 3.1.5 has no known relevant vulnerabilities at the time of the last synthesis run.
curl "https://api.attestd.io/v1/check?product=traefik&version=3.1.5" \
-H "Authorization: Bearer $ATTESTD_KEY"CVE history
Traefik's CVE history concentrates around its middleware processing pipeline, particularly header forwarding, authentication bypass, and request routing. The most severe issues (CVE-2024-45410, CVE-2022-23632) involve header injection that reaches upstream services after bypassing authentication layers.
| CVE | Description | Affects | CVSS |
|---|---|---|---|
CVE-2024-45410 | Header injection via improper handling of HTTP/1.1 requests allows attacker-controlled headers to be forwarded to upstream services. | < 2.11.8, < 3.1.5 | 9.8 |
CVE-2023-47106 | ACME TLS challenge endpoint susceptible to request header injection via malformed Host header values. | < 2.10.6, < 3.0.0-beta5 | 6.5 |
CVE-2022-23632 | TLS verification bypass in ForwardAuth middleware allows request forwarding without valid certificate verification in certain configurations. | < 2.6.1 | 7.4 |
CVE-2022-23633 | Internal service URL exposed in error responses when routing rules do not match, potentially leaking backend topology. | < 2.6.1 | 5.9 |
CVE-2021-32813 | Middleware bypass via forwarded headers accepted from untrusted peer connections before auth middleware evaluation. | < 2.4.13 | 6.5 |