Vulnerability Reporttraefik:v3.7.12

traefik:v3.7.12
digestsha256:9c2a54d87f76f5c2f5f2682c68394af92fb12c0a2686798d6462a3f84bd78eaf

Executive Summary

Last scanned:

Threat Score
50/100CAUTION
Reputation
TRUSTED

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker could exploit CVE-2026-88009 to bypass Traefik routing and path-based authorization and reach protected backend paths, while other findings could cause denial of service. Upgrading Traefik to 3.7.13 fully eliminates CVE-2026-88009. Note: CVE-2026-88007 only applies if HTTP/3 is enabled, the backend uses NTLM or Negotiate authentication, and backend keep-alive is configured.

Relevant for traefik:v3.7.12

Most CVEs in Go images aren't exploitable

This image is a Go binary — most findings can be ruled out with three commands. How to prove which ones are real.

Read the article

Vulnerabilities

Vulnerability Log

55 total
CVE IDAdjusted SeverityPackageExploit ProbabilityRisk Context
CVE-2026-88009MEDIUM6.97
github.com/traefik/traefik/v3
v3.7.12
fixed in 3.7.13
0.4%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-78669MEDIUM6.38
golang.org/x/net
v0.58.0
fixed in 0.60.0
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-84304MEDIUM6.38
google.golang.org/grpc
v1.82.1
fixed in 1.83.1
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-84445MEDIUM6.38
google.golang.org/grpc
v1.82.1
fixed in 1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-78669MEDIUM6.38
stdlib
v1.26.7
fixed in 1.26.9, 1.27.2
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-97031MEDIUM6.38
stdlib
v1.26.7
fixed in 1.26.9, 1.27.2
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-88004MEDIUM6.29
github.com/traefik/traefik/v3
v3.7.12
fixed in 3.7.13
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-88007MEDIUM6.18
github.com/traefik/traefik/v3
v3.7.12
fixed in 3.7.13
0.6%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-88008MEDIUM6.18
github.com/traefik/traefik/v3
v3.7.12
fixed in 3.7.13
0.5%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-63073MEDIUM5.9
libcrypto3
3.5.7-r0
fixed in 3.5.8-r0
1.2%
Low-Moderate Risk
Directly Exposed
CVE-2026-63073MEDIUM5.9
libssl3
3.5.7-r0
fixed in 3.5.8-r0
1.2%
Low-Moderate Risk
Directly Exposed
CVE-2026-81871MEDIUM5.52
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc
v0.20.0
fixed in 0.21.0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-56866MEDIUM5.52
stdlib
v1.26.7
fixed in 1.26.9, 1.27.2
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-94439MEDIUM5.52
stdlib
v1.26.7
fixed in 1.26.9, 1.27.2
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-94448MEDIUM5.18
stdlib
v1.26.7
fixed in 1.26.9, 1.27.2
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-78667MEDIUM5.1
stdlib
v1.26.7
fixed in 1.26.9, 1.27.2
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-97032MEDIUM5.02
golang.org/x/net
v0.58.0
fixed in 0.60.0
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-97032MEDIUM5.02
stdlib
v1.26.7
fixed in 1.26.9, 1.27.2
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-81872MEDIUM4.5
go.opentelemetry.io/otel/sdk/log
v0.20.0
fixed in 0.21.0
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-56855MEDIUM4.5
golang.org/x/crypto
v0.55.0
fixed in 0.56.0
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-78662MEDIUM4.5
golang.org/x/crypto
v0.55.0
fixed in 0.56.0
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-78663MEDIUM4.5
golang.org/x/net
v0.58.0
fixed in 0.60.0
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-78663MEDIUM4.5
stdlib
v1.26.7
fixed in 1.26.9, 1.27.2
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-75803LOW3.15
libcrypto3
3.5.7-r0
fixed in 3.5.8-r0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-75803LOW3.15
libssl3
3.5.7-r0
fixed in 3.5.8-r0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-81870LOW2.8
go.opentelemetry.io/otel/exporters/otlp/otlptrace
v1.44.0
fixed in 1.45.0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-81870LOW2.8
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
v1.44.0
fixed in 1.45.0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-81870LOW2.8
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
v1.44.0
fixed in 1.45.0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-81870LOW2.8
go.opentelemetry.io/otel/sdk
v1.44.0
fixed in 1.45.0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-56857LOW2.8
stdlib
v1.26.7
fixed in 1.26.9, 1.27.2
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-18798LOW2.7
libcrypto3
3.5.7-r0
fixed in 3.5.8-r0
1.5%
Low-Moderate Risk
Post-Exploit
CVE-2026-63076LOW2.7
libcrypto3
3.5.7-r0
fixed in 3.5.8-r0
1.6%
Low-Moderate Risk
Post-Exploit
CVE-2026-14457LOW2.7
libcrypto3
3.5.7-r0
fixed in 3.5.8-r0
1.0%
Low-Moderate Risk
Post-Exploit
CVE-2026-18798LOW2.7
libssl3
3.5.7-r0
fixed in 3.5.8-r0
1.5%
Low-Moderate Risk
Post-Exploit
CVE-2026-63076LOW2.7
libssl3
3.5.7-r0
fixed in 3.5.8-r0
1.6%
Low-Moderate Risk
Post-Exploit
CVE-2026-14457LOW2.7
libssl3
3.5.7-r0
fixed in 3.5.8-r0
1.0%
Low-Moderate Risk
Post-Exploit
CVE-2026-14456LOW2.29
libcrypto3
3.5.7-r0
fixed in 3.5.8-r0
0.7%
Theoretical Threat
Post-Exploit
CVE-2026-63072LOW2.29
libcrypto3
3.5.7-r0
fixed in 3.5.8-r0
0.9%
Theoretical Threat
Post-Exploit
CVE-2026-54874LOW2.29
libcrypto3
3.5.7-r0
fixed in 3.5.8-r0
0.6%
Theoretical Threat
Post-Exploit
CVE-2026-63074LOW2.29
libcrypto3
3.5.7-r0
fixed in 3.5.8-r0
0.6%
Theoretical Threat
Post-Exploit
CVE-2026-63075LOW2.29
libcrypto3
3.5.7-r0
fixed in 3.5.8-r0
0.8%
Theoretical Threat
Post-Exploit
CVE-2026-14456LOW2.29
libssl3
3.5.7-r0
fixed in 3.5.8-r0
0.7%
Theoretical Threat
Post-Exploit
CVE-2026-63072LOW2.29
libssl3
3.5.7-r0
fixed in 3.5.8-r0
0.9%
Theoretical Threat
Post-Exploit
CVE-2026-54874LOW2.29
libssl3
3.5.7-r0
fixed in 3.5.8-r0
0.6%
Theoretical Threat
Post-Exploit
CVE-2026-63074LOW2.29
libssl3
3.5.7-r0
fixed in 3.5.8-r0
0.6%
Theoretical Threat
Post-Exploit
CVE-2026-63075LOW2.29
libssl3
3.5.7-r0
fixed in 3.5.8-r0
0.8%
Theoretical Threat
Post-Exploit
CVE-2026-85091NONE0
zlib
1.3.2-r0
fixed in 1.3.2-r1
0.4%
Theoretical Threat
Not Applicable
GO-2026-5932NONE0
golang.org/x/crypto
v0.55.0
No fix yet
—
Not Applicable
CVE-2026-78659NONE0
golang.org/x/net
v0.58.0
fixed in 0.60.0
0.6%
Theoretical Threat
Not Applicable
CVE-2026-78660NONE0
golang.org/x/net
v0.58.0
fixed in 0.60.0
0.3%
Theoretical Threat
Not Applicable
CVE-2026-84303NONE0
google.golang.org/grpc
v1.82.1
fixed in 1.83.1
0.3%
Theoretical Threat
Not Applicable
CVE-2026-78659NONE0
stdlib
v1.26.7
fixed in 1.26.9, 1.27.2
0.6%
Theoretical Threat
Not Applicable
CVE-2026-78660NONE0
stdlib
v1.26.7
fixed in 1.26.9, 1.27.2
0.3%
Theoretical Threat
Not Applicable
CVE-2026-94440NONE0
stdlib
v1.26.7
fixed in 1.26.9, 1.27.2
0.4%
Theoretical Threat
Not Applicable
CVE-2026-97030NONE0
stdlib
v1.26.7
fixed in 1.26.9, 1.27.2
0.2%
Theoretical Threat
Not Applicable

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Supply chain analysis

Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.