Vulnerability Reporttraefik:v2.11.55

traefik:v2.11.55

digestsha256:4f87b6b33c1da7a20cf304e8f7340fae1c5da055d3a47095714c39a1ed3d9aa3

Executive Summary

Last scanned: Oct 21, 2026

Threat ScoreCAUTION• Threat score 50 and exposed_total 34, including 11 findings at severity 6.0 or higher and max 6.97, place this image in CAUTION.• CVE-2026-88009 is the top exposed-surface issue: crafted HTTP/1 requests can bypass routing/path-scoped authorization and evade access logs in Traefik v2.11.55.• CVE-2026-88011 can let a client spoof identity through dot-form header aliases on normalization-prone backends; aliasHeadersStrategy must be configured as delete or reject to mitigate.• CVE-2026-88007 can allow backend auth session reuse and data exposure, but only if HTTP/3, NTLM/Negotiate backend auth, and keep-alive are enabled.• Post-exploit-only findings are present (16 total) but none are severity 6.0 or higher, with max 2.7.

50/100CAUTION

ReputationOFFICIAL• Official Docker Hub Image• Pinned by digest (Immutable)

TRUSTED

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker could exploit the Traefik issues to bypass path-scoped authorization, evade access logs, spoof backend identity, or cause service disruption. The image has 34 exposed-surface findings, including 11 at severity 6.0 or higher, with a maximum exposed severity of 6.97. Upgrading Traefik to fixed versions fully mitigates CVE-2026-88009, and the CVE-2026-88011 alias-header issue is fully mitigated only when aliasHeadersStrategy is configured as delete or reject. A separate HTTP/3 issue only applies when HTTP/3, NTLM/Negotiate backend auth, and keep-alive are configured, so disabling HTTP/3 removes that exposure.

Relevant for traefik:v2.11.55

Most CVEs in Go images aren't exploitable

This image is a Go binary — most findings can be ruled out with three commands. How to prove which ones are real.

Read the article

Vulnerabilities

Vulnerability Log

50 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-88009	MEDIUM6.97	github.com/traefik/traefik/v2 v2.11.55 fixed in 2.11.57	0.4% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-88011	MEDIUM6.88	github.com/traefik/traefik/v2 v2.11.55 fixed in 2.11.56	0.4% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-88012	MEDIUM6.38	github.com/traefik/traefik/v2 v2.11.55 fixed in 2.11.56	0.5% Theoretical Threat	Directly Exposed
CVE-2026-78669	MEDIUM6.38	golang.org/x/net v0.58.0 fixed in 0.60.0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-84304	MEDIUM6.38	google.golang.org/grpc v1.82.1 fixed in 1.83.1	0.6% Theoretical Threat	Directly Exposed
CVE-2026-84445	MEDIUM6.38	google.golang.org/grpc v1.82.1 fixed in 1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e	0.6% Theoretical Threat	Directly Exposed
CVE-2026-78667	MEDIUM6.38	stdlib v1.26.6 fixed in 1.26.9, 1.27.2	0.4% Theoretical Threat	Directly Exposed
CVE-2026-78669	MEDIUM6.38	stdlib v1.26.6 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly Exposed
CVE-2026-97031	MEDIUM6.38	stdlib v1.26.6 fixed in 1.26.9, 1.27.2	0.4% Theoretical Threat	Directly Exposed
CVE-2026-88007	MEDIUM6.18	github.com/traefik/traefik/v2 v2.11.55 fixed in 2.11.57	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-88008	MEDIUM6.18	github.com/traefik/traefik/v2 v2.11.55 fixed in 2.11.57	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-63073	MEDIUM5.9	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	1.2% Low-Moderate Risk	Directly Exposed
CVE-2026-63073	MEDIUM5.9	libssl3 3.5.7-r0 fixed in 3.5.8-r0	1.2% Low-Moderate Risk	Directly Exposed
CVE-2026-56866	MEDIUM5.52	stdlib v1.26.6 fixed in 1.26.9, 1.27.2	0.3% Theoretical Threat	Directly Exposed
CVE-2026-94439	MEDIUM5.52	stdlib v1.26.6 fixed in 1.26.9, 1.27.2	0.3% Theoretical Threat	Directly Exposed
CVE-2026-94448	MEDIUM5.18	stdlib v1.26.6 fixed in 1.26.9, 1.27.2	0.2% Theoretical Threat	Directly Exposed
CVE-2026-97032	MEDIUM5.02	golang.org/x/net v0.58.0 fixed in 0.60.0	0.4% Theoretical Threat	Directly Exposed
CVE-2026-97032	MEDIUM5.02	stdlib v1.26.6 fixed in 1.26.9, 1.27.2	0.4% Theoretical Threat	Directly Exposed
CVE-2026-56855	MEDIUM4.5	golang.org/x/crypto v0.55.0 fixed in 0.56.0	0.5% Theoretical Threat	Directly Exposed
CVE-2026-78662	MEDIUM4.5	golang.org/x/crypto v0.55.0 fixed in 0.56.0	0.4% Theoretical Threat	Directly Exposed
CVE-2026-78663	MEDIUM4.5	golang.org/x/net v0.58.0 fixed in 0.60.0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-78663	MEDIUM4.5	stdlib v1.26.6 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly Exposed
CVE-2026-75803	LOW3.15	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.2% Theoretical Threat	Directly Exposed
CVE-2026-75803	LOW3.15	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.2% Theoretical Threat	Directly Exposed
CVE-2026-56857	LOW2.8	stdlib v1.26.6 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly Exposed
CVE-2026-18798	LOW2.7	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	1.5% Low-Moderate Risk	Post-Exploit
CVE-2026-63076	LOW2.7	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	1.6% Low-Moderate Risk	Post-Exploit
CVE-2026-14457	LOW2.7	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	1.0% Low-Moderate Risk	Post-Exploit
CVE-2026-18798	LOW2.7	libssl3 3.5.7-r0 fixed in 3.5.8-r0	1.5% Low-Moderate Risk	Post-Exploit
CVE-2026-63076	LOW2.7	libssl3 3.5.7-r0 fixed in 3.5.8-r0	1.6% Low-Moderate Risk	Post-Exploit
CVE-2026-14457	LOW2.7	libssl3 3.5.7-r0 fixed in 3.5.8-r0	1.0% Low-Moderate Risk	Post-Exploit
CVE-2026-14456	LOW2.29	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.7% Theoretical Threat	Post-Exploit
CVE-2026-63072	LOW2.29	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.9% Theoretical Threat	Post-Exploit
CVE-2026-54874	LOW2.29	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-63074	LOW2.29	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-63075	LOW2.29	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.8% Theoretical Threat	Post-Exploit
CVE-2026-14456	LOW2.29	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.7% Theoretical Threat	Post-Exploit
CVE-2026-63072	LOW2.29	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.9% Theoretical Threat	Post-Exploit
CVE-2026-54874	LOW2.29	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-63074	LOW2.29	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-63075	LOW2.29	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.8% Theoretical Threat	Post-Exploit
CVE-2026-85091	NONE0	zlib 1.3.2-r0 fixed in 1.3.2-r1	0.4% Theoretical Threat	Not Applicable
GO-2026-5932	NONE0	golang.org/x/crypto v0.55.0 No fix yet	—	Not Applicable
CVE-2026-78659	NONE0	golang.org/x/net v0.58.0 fixed in 0.60.0	0.6% Theoretical Threat	Not Applicable
CVE-2026-78660	NONE0	golang.org/x/net v0.58.0 fixed in 0.60.0	0.3% Theoretical Threat	Not Applicable
CVE-2026-84303	NONE0	google.golang.org/grpc v1.82.1 fixed in 1.83.1	0.3% Theoretical Threat	Not Applicable
CVE-2026-78659	NONE0	stdlib v1.26.6 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Not Applicable
CVE-2026-78660	NONE0	stdlib v1.26.6 fixed in 1.26.9, 1.27.2	0.3% Theoretical Threat	Not Applicable
CVE-2026-94440	NONE0	stdlib v1.26.6 fixed in 1.26.9, 1.27.2	0.4% Theoretical Threat	Not Applicable
CVE-2026-97030	NONE0	stdlib v1.26.6 fixed in 1.26.9, 1.27.2	0.2% Theoretical Threat	Not Applicable

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Supply chain analysis

Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.