Authentication Bypass in Traefik's Load Balancer and Reverse Proxy
CVE-2026-35051
7.8HIGH
What is CVE-2026-35051?
Traefik, a widely-used HTTP reverse proxy and load balancer, contains a vulnerability in its ForwardAuth middleware which could allow an attacker to bypass authentication when configured with trustForwardHeader=false. This risk arises specifically when Traefik operates behind a trusted upstream proxy. Users are strongly urged to update their installations to the latest versions, 2.11.43, 3.6.14, and 3.7.0-rc.2, to secure their deployment. For detailed information, visit the Traefik security advisory and the respective versions' release notes.
Affected Version(s)
traefik < 2.11.43 < 2.11.43
traefik >= 3.0.0-beta1, < 3.6.14 < 3.0.0-beta1, 3.6.14
traefik >= 3.7.0-ea.1, < 3.7.0-rc.2 < 3.7.0-ea.1, 3.7.0-rc.2