Signal is active with 5 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's ForwardAuth and snippet-based authentication middleware. Traefik's forwarded-header sanitization logic targets only canonical header names (e.g., X-Forwarded-Proto) and does not strip or normalize alias variants that use underscores instead of dashes (e.g., X_Forwarded_Proto). These unsanitized alias headers are forwarded intact to the authentication backend. When the backend normalizes underscore and dash header forms equivalently, an attacker can inject spoofed trust context — such as a trusted scheme or host — through the alias headers and bypass authentication on protected routes without valid credentials. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-04-30 | 1 | Patch1 |
| 2026-05-01 | 1 | Disclosure1 |
| 2026-05-12 | 5 | Disclosure3General2 |
CRITICAL: CVE-2026-39858 (CVSS 10) — traefik traefik. CVE: CVE-2026-39858 CVSS: 10 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Severity: CRITICAL Status: Critical advisory
Post summary
The content announces CVE‑2026‑39858 as a critical vulnerability with a CVSS score of 10, but provides no PoC, exploit, patch, or evidence of active exploitation.
--- Validated by the Lyrie Threat Intelligence Pipeline — 3 independent sources confirmed before publication. No speculation. CVE: CVE-2026-39858 CVSS: 10 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Severity: CRITICAL Status: Critical advisory
Post summary
The advisory announces CVE-2026-39858 as a critical vulnerability with a maximum CVSS score of 10, highlighting its severity but providing no proof of exploitation or mitigation info.
CVE: CVE-2026-39858 CVSS: 10 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Severity: CRITICAL Status: Critical advisory Traefik is an HTTP reverse proxy and load balancer.
Post summary
The text reports the discovery of CVE-2026-39858 as a critical vulnerability in Traefik, noting its high CVSS score and advisory status, but provides no further details on exploitation or remediation.
References CVE: CVE-2026-39858 CVSS: 10 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Severity: CRITICAL Status: Critical advisory
Post summary
The text announces a new critical vulnerability (CVE-2026-39858) with detailed CVSS metrics, but provides no evidence of PoC, exploit code, active exploitation, or mitigation steps.
https://lyrie.ai/research/research/cve-2026-39858-traefik-traefik #lyrie #cybersecurity #CVE #threatintel #zerodayattack
Post summary
The tweet solely links to a research page about CVE-2026-39858 and offers no further detail.
CVE-2026-39858 Authentication Bypass in Traefik ForwardAuth via Unsanitized Header Aliases https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-39858
Post summary
The text announces a new authentication bypass vulnerability in Traefik ForwardAuth linked to unsanitized header aliases, but no PoC, exploit code, patch, or active exploitation claims are provided.
CVE-2026-39858 Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in… https://www.cve.org/CVERecord?id=CVE-2026-39858
Post summary
CVE-2026-39858 is an authentication bypass flaw affecting older Traefik versions; newer releases up to 2.11.43, 3.6.14, and 3.7.0‑rc.2 contain the fix.
5 of 5 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | traefik | traefik | - | - | - |
| App | traefik | traefik | 3.7.0 | - | - |
| App | traefik | traefik | 3.7.0 | - | - |
| App | traefik | traefik | 3.7.0 | - | - |
| App | traefik | traefik | 3.7.0 | - | - |