/
← Voltar ao feed
high

CERT-FR: Multiple Traefik vulnerabilities allow data confidentiality compromise and security policy bypass

1 fonte(s) · 1 atualização(ões) · publicado 15/10/2026 21:00 · coletado há 2 dias

CERT-FR advisory CERTFR-2026-AVI-1330, published 16 October 2026, reports multiple vulnerabilities in Traefik. Per the advisory, they allow an attacker to compromise data confidentiality and bypass the security policy. All Traefik versions prior to v3.7.15 are affected. The advisory is based on two vendor security bulletins, GHSA-28hp-c82p-8vqj and GHSA-p8wx-ph99-xgcr, both dated 16 October 2026. It gives no CVE identifiers, exploitation status, technical root cause, IOCs or attribution.

Detalhes técnicos

  • Impacts listed by CERT-FR: data confidentiality compromise and security policy bypass.
  • Affected: Traefik versions prior to v3.7.15.
  • Technical details and severity ratings are in the vendor GitHub advisories and are not reproduced in the CERT-FR notice.

Remediação

  • Consult the Traefik security advisories GHSA-28hp-c82p-8vqj and GHSA-p8wx-ph99-xgcr and upgrade to a fixed release (v3.7.15 or later).

Linha do tempo

  1. cert.ssi.gouv.fr ↗ · pub. 15/10/2026 21:00 · coletado 21/10 12:01 primeiro registro

    CERT-FR: Multiple Traefik vulnerabilities allow data confidentiality compromise and security policy bypass

    ler a análise desta fonte

    CERT-FR advisory CERTFR-2026-AVI-1330, published 16 October 2026, reports multiple vulnerabilities in Traefik. Per the advisory, they allow an attacker to compromise data confidentiality and bypass the security policy. All Traefik versions prior to v3.7.15 are affected. The advisory is based on two vendor security bulletins, GHSA-28hp-c82p-8vqj and GHSA-p8wx-ph99-xgcr, both dated 16 October 2026. It gives no CVE identifiers, exploitation status, technical root cause, IOCs or attribution.

    Technical Details

    • Impacts listed by CERT-FR: data confidentiality compromise and security policy bypass.
    • Affected: Traefik versions prior to v3.7.15.
    • Technical details and severity ratings are in the vendor GitHub advisories and are not reproduced in the CERT-FR notice.

    Remediation

    • Consult the Traefik security advisories GHSA-28hp-c82p-8vqj and GHSA-p8wx-ph99-xgcr and upgrade to a fixed release (v3.7.15 or later).