Traefik patches security policy bypass flaws

Multiple vulnerabilities in Traefik reverse proxy allow attackers to bypass security policy enforcement; patches available.

The French national cybersecurity agency (ANSSI/CERT-FR) issued an advisory covering multiple vulnerabilities in Traefik, a widely used cloud-native reverse proxy and load balancer. The flaws, disclosed by the Traefik project via three GitHub Security Advisories on 9 July 2026, allow an attacker to bypass security policy controls enforced by the proxy, potentially undermining access restrictions or routing rules intended to protect backend services.

Affected versions include Traefik 3.6.x prior to 3.6.23, 3.7.x prior to 3.7.7, and all versions prior to 2.11.52. No indicators of active exploitation are mentioned in the advisory. Organizations running Traefik should apply the vendor-provided patches referenced in the linked GHSA advisories as soon as possible, given Traefik's common role as an ingress and security control point in containerized and microservices environments.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0851