github.com/containous/traefik/v2

The Cloud Native Application Proxy

View on Go

View on Github

Activity

Latest release: 1w ago
Total releases: 66
Cadence: ~19 days
Last 12 months: 25

Reach

Stars: 64.8k

Details

First release: Dec 02, 2019

Releases

Version	Released
`v2.11.57` patch	Sep 04, 2026
`v2.11.56` patch	Aug 26, 2026
`v2.11.55` patch	Aug 18, 2026
`v2.11.54` patch	Jul 31, 2026
`v2.11.53` patch	Jul 24, 2026
`v2.11.52` patch	Jul 08, 2026
`v2.11.51` patch	Jun 30, 2026
`v2.11.50` patch	Jun 10, 2026
`v2.11.49` patch	Jun 05, 2026
`v2.11.48` patch	Jun 04, 2026
`v2.11.47` patch	Jun 03, 2026
`v2.11.46` patch	May 11, 2026
`v2.11.45` patch	May 05, 2026
`v2.11.44` patch	Apr 29, 2026
`v2.11.43` patch	Apr 22, 2026
`v2.11.42` patch	Mar 26, 2026
`v2.11.41` patch	Mar 18, 2026
`v2.11.40` patch	Mar 06, 2026
`v2.11.39` patch	Mar 06, 2026
`v2.11.38` patch	Feb 23, 2026
`v2.11.37` patch	Feb 11, 2026
`v2.11.36` patch	Feb 02, 2026
`v2.11.35` patch	Jan 14, 2026
`v2.11.33` patch	Dec 17, 2025
`v2.11.32` patch	Dec 04, 2025
`v2.11.23` patch	Apr 17, 2025
`v2.11.21` patch	Feb 24, 2025
`v2.11.8` patch	Aug 06, 2024
`v2.11.6` patch	Jul 02, 2024
`v2.11.4` patch	Jun 10, 2024
`v2.11.3` patch	May 21, 2024
`v2.11.2` patch	Apr 11, 2024
`v2.11.1` patch	Apr 10, 2024
`v2.11.0` minor	Feb 12, 2024
`v2.11.0-rc2` pre	Jan 24, 2024
`v2.10.2` minor	Jun 19, 2023
`v2.10.0-rc2` pre	Apr 07, 2023
`v2.9.6` patch	Dec 07, 2022
`v2.9.2` patch	Oct 27, 2022
`v2.9.0` minor	Sep 30, 2022
`v2.9.0-rc4` pre	Sep 23, 2022
`v2.8.2` minor	Aug 11, 2022
`v2.6.6` patch	May 03, 2022
`v2.6.4` patch	May 03, 2022
`v2.7.0-rc1` pre	Mar 24, 2022
`v2.6.1` minor	Feb 14, 2022
`v2.5.7` patch	Jan 20, 2022
`v2.5.4` patch	Nov 08, 2021
`v2.5.2` patch	Sep 02, 2021
`v2.5.1` patch	Aug 20, 2021

1–50 of 66

Repository

containous/traefik

Forks: 6.2k
Open issues: 683
Language: Go
: 6.5/ 10

microservice
docker
marathon
mesos
consul
etcd

Dependencies (89)

Depends on

v2.11.57

Used by

Supply-chain exposure

23 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (3)

CVE-2020-9321 GO-2022-0808 GHSA-7h6j-2268-fhcm Aug 21, 2024

Improper Certificate Handling in github.com/containous/traefik

Improper Certificate Handling in github.com/containous/traefik

Fixed in

2.1.4

References

https://github.com/advisories/GHSA-7h6j-2268-fhcm
https://nvd.nist.gov/vuln/detail/CVE-2020-9321
https://github.com/traefik/traefik/pull/6281
https://github.com/traefik/traefik/releases/tag/v2.1.4

Updated Mar 03, 2026 · Source: OSV.dev
CVE-2019-20894 GO-2022-0774 GHSA-q9mp-79cp-9g8j Aug 21, 2024

Improper Authentication in github.com/containous/traefik

Improper Authentication in github.com/containous/traefik

Fixed in

2.2.2

References

https://github.com/advisories/GHSA-q9mp-79cp-9g8j
https://nvd.nist.gov/vuln/detail/CVE-2019-20894
https://github.com/containous/traefik/commit/2b353971696717e980521b0e4baa1eba66c8d2bf
https://github.com/containous/traefik/pull/7008
https://github.com/containous/traefik/issues/5312

Updated Mar 03, 2026 · Source: OSV.dev
CVE-2020-15129 GHSA-6qq8-5wq3-86rp Feb 11, 2022

Traefik vulnerable to Open Redirect via handling of X-Forwarded-Prefix header

6.1 / 10
Medium
Network High None Required Changed None High None

Summary

There exists a potential open redirect vulnerability in Traefik's handling of the X-Forwarded-Prefix header. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team addressed this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios.

Details

The Traefik API dashboard component doesn't validate that the value of the header X-Forwarded-Prefix is a site relative path and will redirect to any header provided URI.

e.g.

$ curl --header 'Host:traefik.localhost' --header 'X-Forwarded-Prefix:https://example.org' 'http://localhost:8081' <a href="https://example.org/dashboard/">Found</a>.`

Impact

A successful exploitation of an open redirect can be used to entice victims to disclose sensitive information.

Workarounds

By using the headers middleware, the request header X-Forwarded-Prefix value can be overridden by the value . (dot)

https://docs.traefik.io/v2.2/middlewares/headers/#customrequestheaders

https://docs.traefik.io/v1.7/basics/#custom-headers

For more information

If you have any questions or comments about this advisory, open an issue in Traefik.

Credit

This issue was found by the GitHub Application Security Team and reported on behalf of the GHAS by the GitHub Security Lab Team.

Fixed in

2.2.82.3.0-rc3

References

https://github.com/containous/traefik/security/advisories/GHSA-6qq8-5wq3-86rp
https://nvd.nist.gov/vuln/detail/CVE-2020-15129
https://github.com/containous/traefik/pull/7109
https://github.com/containous/traefik/commit/cfa04c300c5db95ae8a52c31a9d973b6dd9c2254
https://github.com/containous/traefik/commit/e63db782c11c7b8bfce30be4c902e7ef8f9f33d2
https://github.com/traefik/traefik/commit/e2c5f3712f68993de8ed3cb30da9ec0aa11acb09

Updated Jul 08, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

minor 10
patch 48
pre 7

66 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More