CVE-2026-41181

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.44, 3.6.15, and 3.7.0-rc.3, there is an information disclosure vulnerability in Traefik's errors (custom error pages) middleware. When the backend returns a response matching the configured status range, the middleware forwards the original request's complete header set, including Authorization, Cookie, and other authentication material, to the separate error page service rather than only the minimal context needed to render the error page. This behavior is undocumented: the documentation states only that Host is forwarded by default, so operators are not warned that sensitive credentials are shared across service boundaries. Deployments using the errors middleware with a distinct error page service may inadvertently expose end-user credentials to infrastructure that was not intended to receive them. This vulnerability is fixed in 2.11.44, 3.6.15, and 3.7.0-rc.3.

• CWE-201

• https://github.com/traefik/traefik/releases/tag/v2.11.44Product, Release Notes
• https://github.com/traefik/traefik/releases/tag/v3.6.15Product, Release Notes
• https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.3Product, Release Notes
• https://github.com/traefik/traefik/security/advisories/GHSA-p6hg-qh38-555rExploit, Mitigation, Patch, Vendor Advisory

Published

May 15, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41176Rclone is a command-line program to sync files and directori…9.8
• CVE-2026-41177Squidex is an open source headless content management system…5.5
• CVE-2026-41178OpenTelemetry-Go is the Go implementation of OpenTelemetry. …5.3
• CVE-2026-41179Rclone is a command-line program to sync files and directori…9.8
• CVE-2026-4118The Call To Action Plugin plugin for WordPress is vulnerable…4.3
• CVE-2026-41180PsiTransfer is an open source, self-hosted file sharing solu…7.5
• CVE-2026-41182LangSmith Client SDKs provide SDK's for interacting with the…5.3
• CVE-2026-41183FreeScout is a free self-hosted help desk and shared mailbox…4.3
• CVE-2026-41184In Calico, the install-cni init container logs the rendered …6.5
• CVE-2026-41185When Calico is configured with the Azure IPAM plugin, the Ca…6.5
• CVE-2026-41186When Calico's shared debug server is enabled (disabled by de…7.5
• CVE-2026-41187Calico's apiserver wraps tier-scoped resources so that every…6.5