CVE-2026-35051

Katalog CVE

CVSS 10.0 · Critical EPSS 0,31%

Kerentanan Insufficient Verification of Data Authenticity pada traefik. Skor CVSS 3.1 10.0 (Critical) menurut NVD.

Deskripsi (NVD)

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is an authentication bypass vulnerability in Traefik's ForwardAuth middleware when trustForwardHeader=false is configured and Traefik is deployed behind a trusted upstream proxy. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.

Rincian

Terbit di NVD

30 April 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

10.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-345: Insufficient Verification of Data Authenticity
CWE-501: Trust Boundary Violation

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 21,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/traefik/traefik/security/advisories/GHSA-6384-m2mw-rf54 exploit · patch · advisory vendor
• https://github.com/traefik/traefik/releases/tag/v2.11.43 product · release notes
• https://github.com/traefik/traefik/releases/tag/v3.6.14 product · release notes
• https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2 product · release notes
• https://access.redhat.com/errata/RHSA-2026:21772
• https://access.redhat.com/security/cve/CVE-2026-35051
• https://bugzilla.redhat.com/show_bug.cgi?id=2464235
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35051.json