Traefik Reverse Proxy Vulnerability Under Investigation: Early Warning
An unauthenticated attacker may be able to make a different client read a smuggled response in Traefik's default reverse proxy configuration. Users of Traefik are advised to upgrade to mitigate this vulnerability.
What happened
Traefik's default reverse proxy configuration reportedly forwards plain HTTP/2 or HTTP/3 `CONNECT` requests and their bodies to an HTTP/1.1 upstream through a shared `net/http.Transport`. If the upstream answers the `CONNECT` with a keep-alive non-2xx response and does not drain the body, Traefik is said to return the now desynchronized backend socket to its shared pool and reuse it for other clients. An unauthenticated attacker may be able to exploit this to make a different client read the attacker's smuggled response.
To mitigate this vulnerability, it is recommended to upgrade to Traefik v2.11.53, v3.6.24, or v3.7.9. The specific versions affected by this issue are currently under investigation. For more details, consult the primary sources listed below.
This vulnerability, tracked as GHSA-3ccp-42pg-hgv6, is one of several recently disclosed in Traefik. Other issues include authentication bypass via path traversal (GHSA-cxjq-mrr5-89rv), X-Forwarded-Port spoofing in ForwardAuth middleware (GHSA-3q9r-p662-5j8m), and a bypass for `allowCrossNamespace=false` (GHSA-62fc-8686-hfmq). Users should review all advisories to ensure their installations are fully patched.
How 0Day mitigates this
traefik is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.