CVE-2026-35051
EUVD-2026-2642630.04.2026, 21:16
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is an authentication bypass vulnerability in Traefik's ForwardAuth middleware when trustForwardHeader=false is configured and Traefik is deployed behind a trusted upstream proxy. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| traefik | traefik | 𝑥 < 2.11.43 |
| traefik | traefik | 3.0.0 ≤ 𝑥 < 3.6.14 |
| traefik | traefik | 3.7.0:ea1 |
| traefik | traefik | 3.7.0:ea2 |
| traefik | traefik | 3.7.0:ea3 |
| traefik | traefik | 3.7.0:rc1 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources
(CNA/ADP records, vendor advisories, Enginsight analysis).
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Red Hat OpenShift Dev Spaces 3.28 | 1779786779 ≤ 𝑥 < * | ADP |
Common Weakness Enumeration
- CWE-345 - Insufficient Verification of Data AuthenticityThe software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
- CWE-501 - Trust Boundary ViolationThe product mixes trusted and untrusted data in the same data structure or structured message.
References