CVE catalog
CVE-2026-41181
Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.44, 3.6.15, and 3.7.0-rc.3, there is an information disclosure vulnerability in Traefik's errors (custom error pages) middleware. When
- Severity
- Medium · CVSS 6.9
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.45% · Oct 25, 2026
A flaw was found in Traefik, an HTTP reverse proxy and load balancer. The errors (custom error pages) middleware can inadvertently expose end-user credentials. When a backend returns a response matching a configured status range, the middleware forwards the original request's complete header set, including sensitive authentication material like Authorization and Cookie headers, to a separate error page service. This can lead to the disclosure of sensitive user credentials to infrastructure not intended to receive them. traefik: Traefik: Information disclosure via errors middleware exposing user credentials The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | traefik | Not reported | 2.11.44 | fixed |
| Cpe | traefik | Not reported | 3.6.15 | fixed |
| Cpe | traefik | Not reported | Not reported | unknown |
| Go | github.com/traefik/traefik | Not reported | Not reported | unknown |
| Go | github.com/traefik/traefik/v2 | Not reported | 2.11.44 | fixed |
| Go | github.com/traefik/traefik/v3 | Not reported | 3.7.0-rc.3 | fixed |
| Go | github.com/traefik/traefik/v3 | Not reported | 3.6.15 | fixed |
| Opensuse | traefik | tumbleweed | 3.6.16-1.1 | fixed |
| Opensuse | traefik2 | tumbleweed | 2.11.45-1.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | traefik | cpe | Not reported | 2.11.44 | Not reported | Not reported | Not reported |
| Cpe | traefik | cpe | Not reported | 3.6.15 | Not reported | Not reported | Not reported |
| Go | github.com/traefik/traefik/v2 | Go | Not reported | 2.11.44 | Not reported | Not reported | Not reported |
| Go | github.com/traefik/traefik/v3 | Go | Not reported | 3.7.0-rc.3 | Not reported | Not reported | Not reported |
| Go | github.com/traefik/traefik/v3 | Go | Not reported | 3.6.15 | Not reported | Not reported | Not reported |
| Opensuse | traefik | rpm | tumbleweed | 3.6.16-1.1 | Not reported | OPENSUSE-SU-2026:10713-1 | Not reported |
| Opensuse | traefik2 | rpm | tumbleweed | 2.11.45-1.1 | Not reported | OPENSUSE-SU-2026:10714-1 | Not reported |
OpenFactory catalog packages
[openSUSE Tumbleweed]
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10713-1.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-41181]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10713-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10714-1]
- [https://pkg.go.dev/vuln/GO-2026-5532]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41181.json]
[FIRST EPSS] · [Go Vulnerability Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]