https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T10:16:15.720741+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0531 certfr-2026-avi-0531 — Une vulnérabilité a été découverte dans Traefik. Elle permet à un attaquant de provoquer une atteinte à la confidential… 2026-10-06T10:16:15.725516+00:00 certfr-2026-avi-0531 https://cve.radiocsirt.org/vuln/cleanstart-2026-mz53124 CLEANSTART-2026-MZ53124 — Security fix for CVE-2026-41181 applied in: forecastle 1.0.159-r1 2026-10-06T10:16:15.725557+00:00

Affected: CleanStart: forecastle

Security vulnerability affects the forecastle package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-319123 EUVD-2026-319123 2026-10-06T10:16:15.725589+00:00 EUVD-2026-319123 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41181 fkie_cve-2026-41181 2026-10-06T10:16:15.725603+00:00

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.44, 3.6.15, and 3.7.0-rc.3, there is an information disclosure vulnerability in Traefik's errors (custom error pages) middleware. When the backend returns a response matching the configured status range, the middleware forwards the original request's complete header set, including Authorization, Cookie, and other authentication material, to the separate error page service rather than only the minimal context needed to render the error page. This behavior is undocumented: the documentation states only that Host is forwarded by default, so operators are not warned that sensitive credentials are shared across service boundaries. Deployments using the errors middleware with a distinct error page service may inadvertently expose end-user credentials to infrastructure that was not intended to receive them. This vulnerability is fixed in 2.11.44, 3.6.15, and 3.7.0-rc.3.

 https://cve.radiocsirt.org/vuln/ghsa-p6hg-qh38-555r GHSA-p6hg-qh38-555r — Traefik's errors middleware forwards Authorization and Cookie headers to separate error page service 2026-10-06T10:16:15.725631+00:00

Affected: Go: github.com/traefik/traefik/v2, Go: github.com/traefik/traefik/v3

## Summary

There is a medium severity information disclosure vulnerability in Traefik's `errors` (custom error pages) middleware. When the backend returns a response matching the configured status range, the middleware forwards the original request's complete header set, including `Authorization`, `Cookie`, and other authentication material, to the separate error page service rather than only the minimal context needed to render the error page. This behavior is undocumented: the documentation states only that `Host` is forwarded by default, so operators are not warned that sensitive credentials are shared across service boundaries. Deployments using the `errors` middleware with a distinct error page service may inadvertently expose end-user credentials to infrastructure that was not intended to receive them.

## Patches

- https://github.com/traefik/traefik/releases/tag/v2.11.44 - https://github.com/traefik/traefik/releases/tag/v3.6.15 - https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.3

## For more information

If there are any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

<details> <summary>Original Description</summary>

## Description Traefik v3.6.13's supported HTTP `errors` middleware discloses sensitive request headers to the configured error page service when the original backend response matches the configured status range and the middleware takes its default header-forwarding path. In the r…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10713-1 openSUSE-SU-2026:10713-1 — traefik-3.6.16-1.1 on GA media 2026-10-06T10:16:15.725763+00:00

traefik-3.6.16-1.1 on GA media