Is github.com/traefik/traefik safe ? github.com/traefik/traefik (go) has 69 known vulnerabilities, the worst rated CRITICAL. No single fixed version is recorded that clears every advisory, so check each one below. No malicious-package signal is recorded.
// reach 102 direct dependencies
15 carry known advisories, worst CRITICAL
0 packages depend on it
an advisory here reaches each of them
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so go packages are not covered.
cvss CVSS v4.0 base score out of 10; GitHub rates it CRITICAL
epss chance of exploitation in 30 days, 44th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-cxjq-mrr5-89rv, the advisory selected below
// 69 advisories GHSA-cxjq-mrr5-89rv There is a critical authentication-bypass vulnerability in Traefik's ReplacePathRegex middleware. CRIT GHSA-62c8-mh53-4cqv There is a vulnerability in Traefik that allows the client to remove the X-Forwarded headers (except the header X-Forwarded-For). CRIT GHSA-3ccp-42pg-hgv6 There is a critical vulnerability in Traefik's default HTTP reverse proxy that leads to unauthenticated cross-user response poisoning. HIGH GHSA-9cr8-q42q-g8m7 There is a critical vulnerability in Traefik's HTTP/3 (QUIC) TLS configuration selection that allows unauthenticated clients to bypass router-specific mTLS… HIGH GHSA-6jwx-7vp4-9847 There is a high severity authentication bypass vulnerability in Traefik's StripPrefixRegex middleware when used in combination with ForwardAuth, BasicAuth, or… HIGH GHSA-6384-m2mw-rf54 There is a high-severity authentication bypass vulnerability in Traefik's ForwardAuth middleware when trustForwardHeader=false is configured and Traefik is… HIGH GHSA-5m6w-wvh7-57vm There is a high severity authentication bypass vulnerability in Traefik's ForwardAuth and snippet-based authentication middleware. HIGH GHSA-wvvq-wgcr-9q48 There is a potential vulnerability in Traefik's TLS SNI pre-sniffing logic related to fragmented ClientHello packets. HIGH GHSA-gv8r-9rw9-9697 There is a potential vulnerability in Traefik managing HTTP/3 connections. HIGH GHSA-6p68-w45g-48j7 There is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher. HIGH Show all 69 advisories There is a critical authentication-bypass vulnerability in Traefik's ReplacePathRegex middleware.
Full advisory text at GitHub advisory or NVD .
// cvss v4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Attack vector Network
Attack complexity Low
Attack requirements None
Privileges required None
User interaction None
Confidentiality (vulnerable system) None
Integrity (vulnerable system) None
Availability (vulnerable system) None
Confidentiality (subsequent systems) High
Integrity (subsequent systems) High
Availability (subsequent systems) None // questions Is github.com/traefik/traefik safe to install? CyberXYZ does not call a package safe in absolute terms. It records 69 known vulnerabilities for github.com/traefik/traefik (go), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does github.com/traefik/traefik have known vulnerabilities? Yes. CyberXYZ records 69 known vulnerabilities for github.com/traefik/traefik (go), the worst rated CRITICAL. These include GHSA-cxjq-mrr5-89rv, GHSA-62c8-mh53-4cqv, GHSA-3ccp-42pg-hgv6, GHSA-9cr8-q42q-g8m7, GHSA-6jwx-7vp4-9847.
How do I check github.com/traefik/traefik before installing? Search github.com/traefik/traefik in CyberXYZ Check at https://cyberxyz.io/check?q=github.com%2Ftraefik%2Ftraefik . The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 06:04 UTC. The most recent advisory here was published 2026-09-22. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page