BlackTreeCVE Intelligencetraefik · traefik
Official source article: GitHub GHSA-P6HG-QH38-555R ↗. Check the applicable product and release in the original source.
Medium technical severity with public exploit material referenced by a structured source; prioritise exposed affected systems while verifying vendor guidance.
These OSV and GitHub advisory ranges apply only to the named package and ecosystem. A listed fixed version is not a universal product patch or proof that an update is installed.
| Ecosystem and package | Affected range | First fixed version | Evidence |
|---|---|---|---|
| gogithub.com/traefik/traefik/v2 | <= 2.11.43 | 2.11.44 | GitHub advisory ↗upstream repository advisory · 15 May 2026 |
| gogithub.com/traefik/traefik/v3 | <= 3.6.14 | 3.6.15 | GitHub advisory ↗upstream repository advisory · 15 May 2026 |
| gogithub.com/traefik/traefik/v3 | >= 3.7.0-rc.0, <= 3.7.0-rc.2 | 3.7.0-rc.3 | GitHub advisory ↗upstream repository advisory · 15 May 2026 |
Medium technical severity with public exploit material referenced by a structured source; prioritise exposed affected systems while verifying vendor guidance.
Patch availableTraefik is an HTTP reverse proxy and load balancer. Prior to 2.11.44, 3.6.15, and 3.7.0-rc.3, there is an information disclosure vulnerability in Traefik's errors (custom error pages) middleware. When the backend returns a response matching the configured status range, the middleware forwards the original request's complete header set, including Authorization, Cookie, and other authentication material, to the separate error page service rather than only the minimal context needed to render the error page. This behavior is undocumented: the documentation states only that Host is forwarded by default, so operators are not warned that sensitive credentials are shared across service boundaries. Deployments using the errors middleware with a distinct error page service may inadvertently expose end-user credentials to infrastructure that was not intended to receive them. This vulnerability is fixed in 2.11.44, 3.6.15, and 3.7.0-rc.3.
Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.44, 3.6.15, and 3.7.0-rc.3, there is an information disclosure vulnerability in Traefik's errors (custom error pages) middleware. When the backend returns a response matching the configured status range, the middleware forwards the original request's complete header set, including Authorization, Cookie, and other authentication material, to the separate error page service rather than only the minimal context needed to render the error page. This behavior is undocumented: the documentation states only that Host is forwarded by default, so operators are not warned that sensitive credentials are shared across service boundaries. Deployments using the errors middleware with a distinct error page service may inadvertently expose end-user credentials to infrastructure that was not intended to receive them. This vulnerability is fixed in 2.11.44, 3.6.15, and 3.7.0-rc.3.
The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may obtain information outside the intended access boundary.
Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.44, 3.6.15, and 3.7.0-rc.3, there is an information disclosure vulnerability in Traefik's errors (custom error pages) middleware. When the backend returns a response matching the configured status range, the middleware forwards the original request's complete header set, including Authorization, Cookie, and other authentication material, to the separate error page service rather than only the minimal context needed to render the error page. This behavior is undocumented: the documentation states only that Host is forwarded by default, so operators are not warned that sensitive credentials are shared across service boundaries. Deployments using the errors middleware with a distinct error page service may inadvertently expose end-user credentials to infrastructure that was not intended to receive them. This vulnerability is fixed in 2.11.44, 3.6.15, and 3.7.0-rc.3.
The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may obtain information outside the intended access boundary.
CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.
No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.
A structured CVE source labels at least one public reference as exploit material. BlackTree has not independently validated that it is safe, reliable or weaponised.
CWE-201: Insertion of Sensitive Information Into Sent Data. The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:NCommon Vulnerability Scoring System 4.0: the compact vector below is decoded into plain language.
Operational remediation based on structured source evidence.
Published 15 May 2026 · Last source change 16 May 2026, 01:11 UTC · CWE-201 · Insertion of Sensitive Information Into Sent Data
Core structured fields are present and their contributing authorities are shown above.
No material field changes have been recorded since change tracking began. Routine source refreshes and cosmetic edits are intentionally excluded.