7.8

GHSA-GV8R-9RW9-9697: traefik Go

CVSS: 7.8v4.0HighPublished
AliasesGO-2026-4530
Published 23-02-2026Last modified 23-02-2026
Open JSON

Vulnerability summary

GHSA-GV8R-9RW9-9697 is a high (CVSS 7.8) vulnerability in traefik Go.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v4.0 (OSV · Go), selected by version preference
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4
CGA-CGQP-348G-QGPPCGA-G998-68XW-QQHHCGA-R7H6-G8MH-FVFVCGA-W7PX-WW44-86X8

Timeline

  1. 23-02-2026
    PublishedVulnerability first disclosed.
  2. 23-02-2026
    Last modifiedVulnerability information updated.

Description

Traefik affected by TLS ClientAuth Bypass on HTTP/3 in github.com/traefik/traefik

CVSS metrics

2 scores · 1 source · 2 versions

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Github.com/traefik/traefik2 products
  • v2< 2.11.37
  • v3< 3.6.8
Github.com/traefik1 product
  • traefik≤ 1.7.34 | All versions (No fix recorded)

2 vendors · 3 products

References

2 links