CVE-2026-35051
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is an authentication bypass vul
CVSS
10.0
Critical
EPSS
0.3%
p19
KEV
—
Exploit Today
6
0-100
Published: Apr 30, 2026 · Last modified: Jul 15, 2026 · CWE-345 · CWE-501
0.3%EPSS · 30 days0.3%
2026-08-042026-08-31
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is an authentication bypass vulnerability in Traefik's ForwardAuth middleware when trustForwardHeader=false is configured and Traefik is deployed behind a trusted upstream proxy. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.
- github.comhttps://github.com/traefik/traefik/releases/tag/v2.11.43
- github.comhttps://github.com/traefik/traefik/releases/tag/v3.6.14
- github.comhttps://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2
- github.comhttps://github.com/traefik/traefik/security/advisories/GHSA-6384-m2mw-rf54
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:21772
- access.redhat.comhttps://access.redhat.com/security/cve/CVE-2026-35051
- bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2464235
- security.access.redhat.comhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35051.json
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-828135.4 MED—
——0A vulnerability was detected in BEN Group TubeBuddy for YouTube Extension up to 5.8.4 on Chrome. This impacts the function TBGlobal.GetToken of the file tubebuddymaster1.js. The manipulation of the argument t/c/r results in insufficient verification of data authenticity. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.8hCVE-2026-828115.4 MED—
——0A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.1dCVE-2026-828589.8 CRI8.5%
——3@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to perform unsafe reconciliation operations.2dCVE-2026-19410—9.5%
——3An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression.
This vulnerability was patched on 24 June 2026, and no customer action is needed.1dCVE-2026-825498.3 HIG8.2%
——2A vulnerability was identified in Linux Foundation Magma 1.9.0. This affects an unknown function of the component SecurityModeComplete Handler. Such manipulation leads to improper validation of integrity check value. The attack may be launched remotely. The exploit is publicly available and might be used.8hCVE-2026-824655.3 MED7.6%
——2pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest(). When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated attacker to submit an unsigned LogoutRequest with a guessed identifier (e.g., an email address used as NameID) to terminate a victim's SAML session.3d