Vulnerability Reporttraefik:v2.11.56

traefik:v2.11.56

digestsha256:56aeacdccfc513c5757a69bbd99625381ea90a6fae59bf7abe06f6235736e3da

Executive Summary

Last scanned: Oct 21, 2026

Threat ScoreCAUTION• Trust is strong: the image is an official Docker Hub image and pinned by digest, but this does not remove runtime vulnerability risk.• Vulnerability stats show 48 exposed findings, including 8 at severity >= 6.0 and a maximum exposed severity of 6.97; no post-exploit-only findings were reported.• The highest-severity exposed issue is CVE-2026-88009, an authorization-bypass and access-log-evasion flaw in Traefik's HTTP/1 request handling.• Additional exposed issues include CVE-2026-88008 (HTTP/2 protocol-confusion authorization bypass) and CVE-2026-88007 (HTTP/3 NTLM backend connection reuse), both requiring specific configurations.• Because 8 exposed findings meet the severity >= 6.0 threshold, the pre-calculated threat score places this image in the CAUTION band.

50/100CAUTION

ReputationOFFICIAL• Official Docker Hub Image• Pinned by digest (Immutable)

TRUSTED

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker could bypass authorization and hide activity in access logs through crafted HTTP/1 requests (CVE-2026-88009), and in certain configurations use protocol confusion to reach protected backend paths (CVE-2026-88008). Note: CVE-2026-88008 only applies if the backend accepts h2c upgrades and returns a switching-protocols response. Disabling h2c upgrades on the backend would fully eliminate CVE-2026-88008. The image is official and digest-pinned, but 48 exposed findings remain, with 8 at severity >= 6.0 and a maximum exposed severity of 6.97.

Relevant for traefik:v2.11.56

Most CVEs in Go images aren't exploitable

This image is a Go binary — most findings can be ruled out with three commands. How to prove which ones are real.

Read the article

Vulnerabilities

Vulnerability Log

48 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-88009	MEDIUM6.97	github.com/traefik/traefik/v2 v2.11.56 fixed in 2.11.57	0.4% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-78669	MEDIUM6.38	golang.org/x/net v0.58.0 fixed in 0.60.0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-84304	MEDIUM6.38	google.golang.org/grpc v1.82.1 fixed in 1.83.1	0.6% Theoretical Threat	Directly Exposed
CVE-2026-84445	MEDIUM6.38	google.golang.org/grpc v1.82.1 fixed in 1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e	0.6% Theoretical Threat	Directly Exposed
CVE-2026-78669	MEDIUM6.38	stdlib v1.26.7 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly Exposed
CVE-2026-97031	MEDIUM6.38	stdlib v1.26.7 fixed in 1.26.9, 1.27.2	0.4% Theoretical Threat	Directly Exposed
CVE-2026-88007	MEDIUM6.18	github.com/traefik/traefik/v2 v2.11.56 fixed in 2.11.57	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-88008	MEDIUM6.18	github.com/traefik/traefik/v2 v2.11.56 fixed in 2.11.57	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-63073	MEDIUM5.9	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	1.2% Low-Moderate Risk	Directly Exposed
CVE-2026-63073	MEDIUM5.9	libssl3 3.5.7-r0 fixed in 3.5.8-r0	1.2% Low-Moderate Risk	Directly Exposed
CVE-2026-56866	MEDIUM5.52	stdlib v1.26.7 fixed in 1.26.9, 1.27.2	0.3% Theoretical Threat	Directly Exposed
CVE-2026-94439	MEDIUM5.52	stdlib v1.26.7 fixed in 1.26.9, 1.27.2	0.3% Theoretical Threat	Directly Exposed
CVE-2026-94448	MEDIUM5.18	stdlib v1.26.7 fixed in 1.26.9, 1.27.2	0.2% Theoretical Threat	Directly Exposed
CVE-2026-78667	MEDIUM5.1	stdlib v1.26.7 fixed in 1.26.9, 1.27.2	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-97032	MEDIUM5.02	golang.org/x/net v0.58.0 fixed in 0.60.0	0.4% Theoretical Threat	Directly Exposed
CVE-2026-97032	MEDIUM5.02	stdlib v1.26.7 fixed in 1.26.9, 1.27.2	0.4% Theoretical Threat	Directly Exposed
CVE-2026-18798	MEDIUM4.5	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	1.5% Low-Moderate Risk	Directly Exposed
CVE-2026-63076	MEDIUM4.5	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	1.6% Low-Moderate Risk	Directly Exposed
CVE-2026-14457	MEDIUM4.5	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	1.0% Low-Moderate Risk	Directly Exposed
CVE-2026-18798	MEDIUM4.5	libssl3 3.5.7-r0 fixed in 3.5.8-r0	1.5% Low-Moderate Risk	Directly Exposed
CVE-2026-63076	MEDIUM4.5	libssl3 3.5.7-r0 fixed in 3.5.8-r0	1.6% Low-Moderate Risk	Directly Exposed
CVE-2026-14457	MEDIUM4.5	libssl3 3.5.7-r0 fixed in 3.5.8-r0	1.0% Low-Moderate Risk	Directly Exposed
CVE-2026-56855	MEDIUM4.5	golang.org/x/crypto v0.55.0 fixed in 0.56.0	0.5% Theoretical Threat	Directly Exposed
CVE-2026-78662	MEDIUM4.5	golang.org/x/crypto v0.55.0 fixed in 0.56.0	0.4% Theoretical Threat	Directly Exposed
CVE-2026-78663	MEDIUM4.5	golang.org/x/net v0.58.0 fixed in 0.60.0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-78663	MEDIUM4.5	stdlib v1.26.7 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly Exposed
CVE-2026-14456	LOW3.83	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.7% Theoretical Threat	Directly Exposed
CVE-2026-63072	LOW3.83	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.9% Theoretical Threat	Directly Exposed
CVE-2026-54874	LOW3.83	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-63074	LOW3.83	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-63075	LOW3.83	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.8% Theoretical Threat	Directly Exposed
CVE-2026-14456	LOW3.83	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.7% Theoretical Threat	Directly Exposed
CVE-2026-63072	LOW3.83	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.9% Theoretical Threat	Directly Exposed
CVE-2026-54874	LOW3.83	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-63074	LOW3.83	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-63075	LOW3.83	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.8% Theoretical Threat	Directly Exposed
CVE-2026-75803	LOW3.15	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.2% Theoretical Threat	Directly Exposed
CVE-2026-75803	LOW3.15	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.2% Theoretical Threat	Directly Exposed
CVE-2026-56857	LOW2.8	stdlib v1.26.7 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly Exposed
CVE-2026-85091	NONE0	zlib 1.3.2-r0 fixed in 1.3.2-r1	0.4% Theoretical Threat	Not Applicable
GO-2026-5932	NONE0	golang.org/x/crypto v0.55.0 No fix yet	—	Not Applicable
CVE-2026-78659	NONE0	golang.org/x/net v0.58.0 fixed in 0.60.0	0.6% Theoretical Threat	Not Applicable
CVE-2026-78660	NONE0	golang.org/x/net v0.58.0 fixed in 0.60.0	0.3% Theoretical Threat	Not Applicable
CVE-2026-84303	NONE0	google.golang.org/grpc v1.82.1 fixed in 1.83.1	0.3% Theoretical Threat	Not Applicable
CVE-2026-78659	NONE0	stdlib v1.26.7 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Not Applicable
CVE-2026-78660	NONE0	stdlib v1.26.7 fixed in 1.26.9, 1.27.2	0.3% Theoretical Threat	Not Applicable
CVE-2026-94440	NONE0	stdlib v1.26.7 fixed in 1.26.9, 1.27.2	0.4% Theoretical Threat	Not Applicable
CVE-2026-97030	NONE0	stdlib v1.26.7 fixed in 1.26.9, 1.27.2	0.2% Theoretical Threat	Not Applicable

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Supply chain analysis

Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.