logo

Database

Improper authorization control for web services In github.com/traefik/traefik

Description

Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186) in github.com/traefik/traefik

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. OSV-GO-2026-48972. GHSA-46wh-3698-f2cx3. GHSA-p77j-4mvh-x3m34. GCVE-GHSA-46wh-3698-f2cx5. GHSA-46wh-3698-f2cx

References

1. https://github.com/traefik/traefik/security/advisories/GHSA-46wh-3698-f2cx2. https://github.com/traefik/traefik/blob/67c64ed9b25fbb90f1086977a62827133a7aa01b/go.mod#L1083. https://github.com/traefik/traefik/releases/tag/v2.11.424. https://github.com/traefik/traefik/releases/tag/v3.6.125. https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.3

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.