CVE-2020-9321: Improper Certificate Handling in Traefik
Summary
CVE-2020-9321: Improper Certificate Handling. Affects github.com/traefik/traefik versions < 2.1.4. Fixed in 2.1.4. How to fix ↓
Also tracked for
The same CVE-2020-9321 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Traefik is a popular open-source reverse proxy and load balancer written in Go. It is designed to help developers and system administrators easily deploy microservices and manage network traffic. Traefik is widely used in production environments to route HTTP requests to different services based on various rules and configurations. However, a vulnerability has been discovered in Traefik versions before 2.1.4 and TraefikEE 2.0.0 that mishandles the purging of certificate contents from providers before logging.
Vulnerability Detail
The vulnerability, identified as CVE-2020-9321, arises from a flaw in the configurationwatcher.go file in Traefik. When purging certificate contents from providers, Traefik fails to properly handle the process, leading to sensitive information being logged. This could potentially expose private keys or other confidential data to unauthorized parties. The impact of this vulnerability is considered moderate, with a CVSS score of 4.6. Exploitation of this vulnerability could result in the compromise of sensitive information and potentially lead to further attacks.
How To Fix
Latest published version: v1.7.34 as of 22 Oct 2026
go get github.com/traefik/traefik@v1.7.34Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.4
This is the first release that contains the fix.
go get github.com/traefik/traefik@v2.1.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The best course of action is to upgrade to the latest version of Traefik that includes the necessary fix.
Conclusion
In conclusion, the vulnerability in Traefik versions before 2.1.4 and TraefikEE 2.0.0 could potentially expose sensitive information due to improper certificate handling. Users are advised to upgrade to the latest version of Traefik to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/traefik/traefik →
FAQ
Traefik is an open-source reverse proxy and load balancer designed to help developers and system administrators easily deploy microservices and manage network traffic.
The vulnerability could expose sensitive information, such as private keys, to unauthorized parties. This could potentially lead to further attacks and compromise the security of affected systems.
To fix this vulnerability, it is recommended to upgrade to Traefik version 2.1.4 or later. This version includes a fix for the improper certificate handling issue.
No specific workaround has been provided for this vulnerability. It is recommended to upgrade to the latest version of Traefik that includes the necessary fix.
The CVSS score of this vulnerability is 4.6, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/traefik/traefik.
