Traefik Manager

v0.5.0 Security

This release includes 4 security fixes for security teams reviewing exposed deployments.

Published 4mo Reverse Proxies & Load Balancers

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 4 known CVEs

Topics

alpine-linux bcrypt crsf csrf-protection docker fernet

+13 more

flask flask-limiter flask-session gunicorn phosphor-icons python ruamel-yaml tailwind-css totp traefik traefik-management traefik-web-ui vanilla-js

Affected surfaces

auth

Summary

AI summary

Updates What's New in v0.5.0, Security hardening, and v0.1.0 across a mixed release.

Full changelog

What's New in v0.5.0

Mobile companion app

traefik-manager-mobile v0.1.0 is now available - a React Native companion app for managing Traefik Manager from your phone.

Browse and manage routes, middlewares, and services on the go
Enable/disable routes with a toggle directly from the card
Add new routes and middlewares (12 built-in middleware templates)
Edit mode — toggle to reveal edit and delete actions, keeping the list clean by default
Follows your device light/dark theme automatically
Authenticates via the API key introduced in this release

:android: Download APK (v0.1.0) · Source & docs

Route enable/disable

Toggle any route off without deleting it. Configuration is preserved in manager.yml and can be re-enabled instantly from the Routes tab. Disabled routes are greyed out - Traefik stops routing them until re-enabled.

Live tab filtering

Filter the live services view by Protocol (HTTP/TCP/UDP) and Provider (docker, file, kubernetes, etc.) - provider extracted from the service@provider naming convention. Filter buttons are built dynamically from the available values in your environment.

API key authentication

Generate a scoped app password for mobile dashboards or integrations. Send it via the X-Api-Key header. Revoke instantly from Settings → Authentication without changing your main password or 2FA.

Security hardening

Rate limiting - login, OTP, and change-password endpoints limited per IP via Flask-Limiter (5/min for auth, 10/min for others).
Atomic config writes - dynamic.yml and manager.yml now write to a temp file first, then atomically replace the original. No partial writes on crash.
Encrypted OTP secret - TOTP seed encrypted at rest with Fernet. Key loaded from OTP_ENCRYPTION_KEY env var or auto-generated to /app/config/.otp_key. Existing plaintext secrets are migrated transparently on first load.
Session fixation protection - session ID regenerated after successful login and OTP verification.
Expanded security headers - Content-Security-Policy, Permissions-Policy, and HSTS (when COOKIE_SECURE=true) added to all responses.

Full documentation at chr0nzz.github.io/traefik-manager

Security Fixes

Rate limiting added to login, OTP, and password change endpoints (5/min auth, 10/min others)
Atomic writes for dynamic.yml and manager.yml prevent partial config corruption
OTP secret now encrypted at rest with Fernet using OTP_ENCRYPTION_KEY env var
Session ID regenerated after successful login and OTP verification to prevent fixation

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Traefik Manager

Get notified when new releases ship.

About Traefik Manager

Clean web interface for managing Traefik

All releases →