CVE-2026-26998

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.38 and 3.6.9, there is a potential vulnerability in Traefik managing the ForwardAuth middleware responses. When Traefik is configured to use the ForwardAuth middleware, the response body from the authentication server is read entirely into memory without any size limit. There is no maxResponseBodySize configuration to restrict the amount of data read from the authentication server response. If the authentication server returns an unexpectedly large or unbounded response body, Traefik will allocate unlimited memory, potentially causing an out-of-memory (OOM) condition that crashes the process. This results in a denial of service for all routes served by the affected Traefik instance. This issue has been patched in versions 2.11.38 and 3.6.9.

• CWE-770

• https://github.com/traefik/traefik/releases/tag/v2.11.38Product, Release Notes
• https://github.com/traefik/traefik/releases/tag/v3.6.9Product, Release Notes
• https://github.com/traefik/traefik/security/advisories/GHSA-fw45-f5q2-2p4xPatch, Vendor Advisory

Published

Mar 5, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-26992LibreNMS is an auto-discovering PHP/MySQL/SNMP based network…4.8
• CVE-2026-26993Flare is a Next.js-based, self-hostable file sharing platfor…5.4
• CVE-2026-26994uTLS is a fork of crypto/tls, created to customize ClientHel…6.5
• CVE-2026-26995Rejected reason: Further research determined the issue is an…
• CVE-2026-26996minimatch is a minimal matching utility for converting glob …7.5
• CVE-2026-26997ClipBucket v5 is an open source video sharing platform. Prio…5.4
• CVE-2026-26999Traefik is an HTTP reverse proxy and load balancer. Prior to…7.5
• CVE-2026-27001OpenClaw is a personal AI assistant. Prior to version 2026.2…7.8
• CVE-2026-27002OpenClaw is a personal AI assistant. Prior to version 2026.2…9.8
• CVE-2026-27003OpenClaw is a personal AI assistant. Telegram bot tokens can…5.5
• CVE-2026-27004OpenClaw is a personal AI assistant. Prior to version 2026.2…5.5
• CVE-2026-27005Chartbrew is an open-source web application that can connect…9.8