Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is an authentication bypass vulnerability in Traefik's ForwardAuth middleware when trustForwardHeader=false is configured and Traefik is deployed behind a trusted upstream proxy. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.

The version of Traefik installed on the remote macOS host is prior to 2.11.43 or 3.x prior to 3.6.14. It is, therefore, affected by multiple vulnerabilities:

  - An authentication bypass via StripPrefixRegex and ForwardAuth dot-segment normalization. When StripPrefixRegex     processes URLs with percent-encoded characters, it miscalculates byte offsets, producing a dot-segment path that     authentication middleware fails to match against protection rules. (CVE-2026-40912)

  - An authentication bypass via unsanitized underscore-variant forwarded headers. Traefik's forwarded-header     sanitization logic targets only canonical header names and does not strip alias variants that use underscores     instead of dashes, allowing attackers to inject forged trust context to bypass ForwardAuth. (CVE-2026-39858)

  - An authentication bypass in ForwardAuth when trustForwardHeader is set to false behind a trusted proxy. The     X-Forwarded-Prefix header remains unstripped in authentication subrequests, allowing external attackers to     spoof the header and bypass access controls on protected routes. (CVE-2026-35051)

  - A timing side-channel in BasicAuth that allows username enumeration via bcrypt short-circuit. Due to a map     key/value confusion bug, a fallback security mechanism fails to function properly, enabling attackers to     enumerate valid usernames by analyzing response-time differences. (CVE-2026-41263)

  - A Kubernetes CRD cross-namespace isolation bypass via Chain middleware references. When     allowCrossNamespace is set to false, Traefik fails to apply the same restriction to middleware references     nested inside a Chain middleware, allowing actors to access middleware from other namespaces. (CVE-2026-41174)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2,
    there is an authentication bypass vulnerability in Traefik's ForwardAuth middleware when
    trustForwardHeader=false is configured and Traefik is deployed behind a trusted upstream proxy. This issue
    has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2. (CVE-2026-35051)

ID	Name	Product	Family	Severity
311474	Traefik < 2.11.43 / 3.x < 3.6.14 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
440807	SCA: security update for github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 (GHSA-6384-m2mw-rf54)	Tenable Cloud Security	SCA Checks	high
440807	SCA: security update for github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 (GHSA-6384-m2mw-rf54)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-35051

high

Tenable Plugins

high

high

high