← Vulnerability feed

Vulnerability record · CVE-2020-15129 · published 30 July 2020

CVE-2020-15129: Traefik open redirect vulnerability

Traefik · Traefik

In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, there exists a potential open redirect vulnerability in Traefik's handling of the "X-Forwarded-Prefix" header. The Traefik API dashboard component doesn't validate that the value of the header "X-Forwarded-Prefix" is a site relative path and will redirect to any header provided URI. Successful exploitation of an open redirect can be used to entice victims to disclose sensitive information. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team addressed this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios.

4.7 CVSS 3.1 Medium EPSS 8.0% · top 5.4% CWE-601 · Open redirect
4.7CVSS 3.1 base score, v2 4.0
8.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
12References
17 Jun 2026Last modified by NVD

Description

In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, there exists a potential open redirect vulnerability in Traefik's handling of the "X-Forwarded-Prefix" header. The Traefik API dashboard component doesn't validate that the value of the header "X-Forwarded-Prefix" is a site relative path and will redirect to any header provided URI. Successful exploitation of an open redirect can be used to entice victims to disclose sensitive information. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team addressed this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios.

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/containous/traefik/commit/e63db782c11c7b8bfce30be4c902e7ef8f9f33d2 PatchThird Party Advisory
https://github.com/containous/traefik/pull/7109 PatchThird Party Advisory
https://github.com/containous/traefik/releases/tag/v1.7.26 Release NotesThird Party Advisory
https://github.com/containous/traefik/releases/tag/v2.2.8 Release NotesThird Party Advisory
https://github.com/containous/traefik/releases/tag/v2.3.0-rc3 Release NotesThird Party Advisory
https://github.com/containous/traefik/security/advisories/GHSA-6qq8-5wq3-86rp Third Party Advisory
https://github.com/containous/traefik/commit/e63db782c11c7b8bfce30be4c902e7ef8f9f33d2 PatchThird Party Advisory
https://github.com/containous/traefik/pull/7109 PatchThird Party Advisory
https://github.com/containous/traefik/releases/tag/v1.7.26 Release NotesThird Party Advisory
https://github.com/containous/traefik/releases/tag/v2.2.8 Release NotesThird Party Advisory
https://github.com/containous/traefik/releases/tag/v2.3.0-rc3 Release NotesThird Party Advisory
https://github.com/containous/traefik/security/advisories/GHSA-6qq8-5wq3-86rp Third Party Advisory

Track CVE-2020-15129 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2023-44487HTTP/2 Rapid Reset stream cancellation denial of serviceThe HTTP/2 protocol permits a client to cancel many streams quickly, and the server's handling of those resets consumes disproportionate resources. T…KEVEPSS 100%analysed9.3CVE-2026-88877Traefik insecure direct object reference vulnerabilityTraefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses t…EPSS 0.65%9.3CVE-2026-85595Traefik improper authentication vulnerabilityTraefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware wher…EPSS 0.69%9.1CVE-2026-88007Traefik improper authentication vulnerabilityTraefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call…EPSS 0.60%8.8CVE-2026-88009Traefik http request smuggling vulnerabilityTraefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that G…EPSS 0.44%8.8CVE-2025-32431Traefik path traversal vulnerabilityTraefik (pronounced traffic) is an HTTP reverse proxy and load balancer. In versions prior to 2.11.24, 3.3.6, and 3.4.0-rc2. There is a potential vul…EPSS 0.93%8.7CVE-2023-54365Traefik uncontrolled resource consumption vulnerabilityTraefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard libr…EPSS 0.77%8.2CVE-2026-85596Traefik improper authentication vulnerabilityTraefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The TLS option generated for an …EPSS 0.43%

Source: NIST National Vulnerability Database (record CVE-2020-15129), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.