CVE-2026-35051

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is an authentication bypass vulnerability in Traefik's ForwardAuth middleware when trustForwardHeader=false is configured and Traefik is deployed behind a trusted upstream proxy. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.

• CWE-345
• CWE-501

• https://github.com/traefik/traefik/releases/tag/v2.11.43Product, Release Notes
• https://github.com/traefik/traefik/releases/tag/v3.6.14Product, Release Notes
• https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2Product, Release Notes
• https://github.com/traefik/traefik/security/advisories/GHSA-6384-m2mw-rf54Exploit, Patch, Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:21772
• https://access.redhat.com/security/cve/CVE-2026-35051
• https://bugzilla.redhat.com/show_bug.cgi?id=2464235
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35051.json

Published

Apr 30, 2026

Last Modified

Jul 15, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35046Tandoor Recipes is an application for managing recipes, plan…5.4
• CVE-2026-35047Brave CMS is an open-source CMS. Prior to 2.0.6, an Unrestri…9.8
• CVE-2026-35048The Piwigo installer in versions 16.3.0 and earlier accepts …9.8
• CVE-2026-35049wire-ios is an iOS client for the Wire secure messaging appl…6.5
• CVE-2026-3505Allocation of resources without limits or throttling, Uncont…7.5
• CVE-2026-35050text-generation-webui is an open-source web interface for ru…8.8
• CVE-2026-35052D-Tale is the combination of a Flask back-end and a React fr…9.8
• CVE-2026-35053OneUptime is an open-source monitoring and observability pla…9.8
• CVE-2026-35054XenForo before 2.3.9 is vulnerable to stored cross-site scri…5.4
• CVE-2026-35055XenForo before 2.3.9 and before 2.2.18 is vulnerable to cros…6.1
• CVE-2026-35056XenForo before 2.3.9 and before 2.2.18 allows remote code ex…8.6
• CVE-2026-35057XenForo before 2.3.10 and before 2.2.19 is vulnerable to sto…5.4