Traefik proxy security policy bypass vulnerabilities patched
Multiple security policy bypass vulnerabilities affect Traefik proxy versions 2.11.x, 3.6.x, and 3.7.x; patches available in v2.11.48, v3.6.19, and v3.7.3.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
The French CERT (CERT-FR) has disclosed multiple security policy bypass vulnerabilities in Traefik, a popular cloud-native edge router and reverse proxy. The vulnerabilities affect three major version branches: v2.11.x prior to v2.11.48, v3.6.x prior to v3.6.19, and v3.7.x prior to v3.7.3. These flaws allow an attacker to circumvent security policies enforced by Traefik, potentially enabling unauthorized access to protected resources or services.
Traefik has released security advisories (GHSA-5r4w-85f3-pw66, GHSA-9cr8-q42q-g8m7, GHSA-xf64-8mw2-4gr2) on June 5, 2026, along with patched versions addressing these issues. Two CVE identifiers have been assigned: CVE-2026-48020 and CVE-2026-48491. Organizations using affected Traefik versions should prioritize patching, as the ability to bypass security policies represents a significant risk to perimeter defense and access control mechanisms.
Given Traefik's widespread deployment in containerized and microservices environments, these vulnerabilities could impact a broad range of organizations across multiple sectors. The lack of detailed exploitation information in the advisory suggests responsible disclosure, but organizations should assume active exploitation attempts may follow public disclosure.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0690
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs