CVE-2020-15129

In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, there exists a potential open redirect vulnerability in Traefik's handling of the "X-Forwarded-Prefix" header. The Traefik API dashboard component doesn't validate that the value of the header "X-Forwarded-Prefix" is a site relative path and will redirect to any header provided URI. Successful exploitation of an open redirect can be used to entice victims to disclose sensitive information. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team addressed this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios.

• CWE-601
• CWE-601

• https://github.com/containous/traefik/commit/e63db782c11c7b8bfce30be4c902e7ef8f9f33d2Patch, Third Party Advisory
• https://github.com/containous/traefik/pull/7109Patch, Third Party Advisory
• https://github.com/containous/traefik/releases/tag/v1.7.26Release Notes, Third Party Advisory
• https://github.com/containous/traefik/releases/tag/v2.2.8Release Notes, Third Party Advisory
• https://github.com/containous/traefik/releases/tag/v2.3.0-rc3Release Notes, Third Party Advisory
• https://github.com/containous/traefik/security/advisories/GHSA-6qq8-5wq3-86rpThird Party Advisory
• https://github.com/containous/traefik/commit/e63db782c11c7b8bfce30be4c902e7ef8f9f33d2Patch, Third Party Advisory
• https://github.com/containous/traefik/pull/7109Patch, Third Party Advisory
• https://github.com/containous/traefik/releases/tag/v1.7.26Release Notes, Third Party Advisory
• https://github.com/containous/traefik/releases/tag/v2.2.8Release Notes, Third Party Advisory
• https://github.com/containous/traefik/releases/tag/v2.3.0-rc3Release Notes, Third Party Advisory
• https://github.com/containous/traefik/security/advisories/GHSA-6qq8-5wq3-86rpThird Party Advisory

Published

Jul 30, 2020

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15123In codecov (npm package) before version 3.7.1 the upload met…9.3
• CVE-2020-15124In Goobi Viewer Core before version 4.8.3, a path traversal …6.5
• CVE-2020-15125In auth0 (npm package) versions before 2.27.1, a DenyList of…7.7
• CVE-2020-15126In parser-server from version 3.5.0 and before 4.3.0, an aut…6.5
• CVE-2020-15127In Contour ( Ingress controller for Kubernetes) before versi…7.5
• CVE-2020-15128In OctoberCMS before version 1.0.468, encrypted cookie value…6.3
• CVE-2020-1513An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-15130In SLPJS (npm package slpjs) before version 0.27.4, there is…7.5
• CVE-2020-15131In SLP Validate (npm package slp-validate) before version 1.…7.5
• CVE-2020-15132In Sulu before versions 1.6.35, 2.0.10, and 2.1.1, when the …5.3
• CVE-2020-15133In faye-websocket before version 0.11.0, there is a lack of …8.7
• CVE-2020-15134Faye before version 1.4.0, there is a lack of certification …8.7