CVE-2026-41181
MEDIUMDescription
Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.44, 3.6.15, and 3.7.0-rc.3, there is an information disclosure vulnerability in Traefik's errors (custom error pages) middleware. When the backend returns a response matching the configured status range, the middleware forwards the original request's complete header set, including Authorization, Cookie, and other authentication material, to the separate error page service rather than only the minimal context needed to render the error page. This behavior is undocumented: the documentation states only that Host is forwarded by default, so operators are not warned that sensitive credentials are shared across service boundaries. Deployments using the errors middleware with a distinct error page service may inadvertently expose end-user credentials to infrastructure that was not intended to receive them. This vulnerability is fixed in 2.11.44, 3.6.15, and 3.7.0-rc.3.
CVSS v3.1 Score
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| traefik | traefik |
| traefik | traefik |
| traefik | traefik |
| traefik | traefik |
| traefik | traefik |
| traefik | traefik |
| traefik | traefik |
References
Advisories & Patches
Frequently Asked Questions
What is CVE-2026-41181? +
How severe is CVE-2026-41181? +
What products are affected by CVE-2026-41181? +
How do I check if I'm vulnerable to CVE-2026-41181? +
Related Vulnerabilities
Develocity (formerly Gradle Enterprise) before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the …
An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials.
When the device is shared, the homepage module are before 2.19.0 in eWeLink Cloud Service allows Secondary user to take …
YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may include sensitive gflag configurations. To mitigate this, we recommend …
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. The MongoDB …
Sentry-Javascript is an official Sentry SDKs for JavaScript. From version 10.11.0 to before 10.27.0, when a Node.js application using the …