Vulnerability in Traefik
CVE-2026-41181
Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.44, 3.6.15, and 3.7.0-rc.3, there is an information disclosure vulnerability in Traefik's errors (custom error pages) middleware. When the backend returns a response matching the configured status range, the middleware forwards the original request's complete header set, including Authorization, Cookie, and other authentication material, to the separate error page service rather than only the minimal context needed to render the error page. This behavior is undocumented: the documentation states only that Host is forwarded by default, so operators are not warned that sensitive credentials are shared across service boundaries. Deployments using the errors middleware with a distinct error page service may inadvertently expose end-user credentials to infrastructure that was not intended to receive them. This vulnerability is fixed in 2.11.44, 3.6.15, and 3.7.0-rc.3.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.005 (40.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 40th percentile — 40.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.005 · change: +0.001
Affected products
- Traefik — versions 3.7.0, < 2.11.43, >= 3.0.0-beta1, < 3.6.14
Weakness classification (CWE)
References
- github.com/traefik/traefik/security/advisories/GHSA-p6hg-qh38-555r (Exploit, Patch, Mitigation, Vendor Advisory)
- github.com/traefik/traefik/releases/tag/v2.11.44 (Product, Release Notes)
- github.com/traefik/traefik/releases/tag/v3.6.15 (Product, Release Notes)
- github.com/traefik/traefik/releases/tag/v3.7.0-rc.3 (Product, Release Notes)
Frequently asked questions
- What is CVE-2026-41181?
- CVE-2026-41181 is a medium-severity vulnerability in Traefik, classified under Insertion of Sensitive Information into Sent Data. CVSS score: 5.8/10. Published 2026-05-15.
- How severe is CVE-2026-41181?
- Medium severity. CVSS v3 base score is 5.8 out of 10.