Snyk - Open Source Security

Snyk test report

August 27th 2026, 2:50:58 am (UTC+00:00)

Scanned the following paths:
  • docker.io/traefik:v3.7.5/traefik (apk)
  • docker.io/traefik:v3.7.5/traefik/traefik/v3//usr/local/bin/traefik (gomodules)
2 known vulnerabilities
2 vulnerable dependency paths
1969 dependencies

Incorrect Authorization

high severity
Exploit: Not Defined
  • Manifest file: docker.io/traefik:v3.7.5/traefik/traefik/v3 › /usr/local/bin/traefik
  • Package Manager: golang
  • Vulnerable module: google.golang.org/grpc/internal/transport
  • Introduced through: github.com/traefik/traefik/v3@* and google.golang.org/grpc/internal/transport@v1.80.0

Detailed paths

  • Introduced through: github.com/traefik/traefik/v3@* › google.golang.org/grpc/internal/transport@v1.80.0

Overview

Affected versions of this package are vulnerable to Incorrect Authorization in the processing of xDS RBAC policies and HTTP/2 transport handling. An attacker can gain unauthorized access to protected services or cause denial of service by exploiting improper handling of unsupported fields in policy matchers, bypassing rapid reset mitigations, or triggering server panics through crafted policy updates.

Note: This advisory refers to several vulnerabilities as aggregated by the maintainer. For an exact breakdown and affected code, see the Maintainer's referenced advisory and commit.

Workaround

This vulnerability can be mitigated by ensuring xDS management servers do not push RBAC policies with unsupported fields or NOT rules wrapping unhandled fields, and by configuring upstream reverse proxies or load balancers with strict HTTP/2 max_concurrent_streams limits and active rate limiting on RST_STREAM frequency per connection.

Remediation

Upgrade google.golang.org/grpc/internal/transport to version 1.82.1 or higher.

References

More about this vulnerability

Authorization Bypass Through User-Controlled Key

high severity
Exploit: Not Defined
  • Manifest file: docker.io/traefik:v3.7.5/traefik/traefik/v3 › /usr/local/bin/traefik
  • Package Manager: golang
  • Vulnerable module: github.com/valyala/fasthttp
  • Introduced through: github.com/traefik/traefik/v3@* and github.com/valyala/fasthttp@v1.69.0

Detailed paths

  • Introduced through: github.com/traefik/traefik/v3@* › github.com/valyala/fasthttp@v1.69.0

Overview

github.com/valyala/fasthttp is a fast HTTP server and client API.

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the ServeFile and ServeFS functions. An attacker can bypass access controls by submitting double-encoded path variants, which are decoded and interpreted as valid filesystem paths, allowing unauthorized access to protected files.

Remediation

Upgrade github.com/valyala/fasthttp to version 1.70.0 or higher.

References

More about this vulnerability