CVE-2018-15598: Traefik Missing Authentication
Summary
CVE-2018-15598: Traefik Missing Authentication. Affects github.com/traefik/traefik versions >= 1.6.0, < 1.6.6. Fixed in 1.6.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Traefik is a popular reverse proxy and load balancer written in Go. It is designed to help developers easily deploy microservices and manage HTTP traffic. Traefik 1.6.x versions prior to 1.6.6 are affected by a vulnerability that exposes the configuration and secret if authentication is missing and the API's port is publicly reachable.
Vulnerability Detail
The vulnerability in Traefik arises when the --api flag is used, allowing the API to be accessed without authentication. This means that if the API's port is publicly reachable, an attacker can access and retrieve sensitive information, including the configuration and secret data. This can lead to unauthorized access, data leakage, and potential compromise of the system.
How To Fix
Latest published version: v1.7.34 as of 22 Oct 2026
go get github.com/traefik/traefik@v1.7.34Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.6
This is the first release that contains the fix.
go get github.com/traefik/traefik@v1.6.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to ensure that the API's port is not publicly reachable. This can be achieved by configuring appropriate network settings, such as firewall rules or network segmentation, to restrict access to the API port only from trusted sources.
Conclusion
The Traefik Missing Authentication vulnerability in versions prior to 1.6.6 exposes sensitive information if authentication is missing and the API's port is publicly reachable. It is crucial to upgrade to the latest version or implement appropriate network settings to mitigate the risk of unauthorized access and data leakage. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/traefik/traefik →
FAQ
Traefik is a reverse proxy and load balancer designed to help developers deploy and manage microservices.
Traefik versions 1.6.x prior to 1.6.6 are affected.
The vulnerability can lead to unauthorized access, data leakage, and potential compromise of the system.
Upgrade to Traefik version 1.6.6 or later, or implement appropriate network settings to restrict access to the API port.
You can find more information about this vulnerability in the Traefik documentation and the associated CVE entry.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/traefik/traefik.
