Security Deep Dive
traefik
Security posture and CVE patch evidence from tracked releases.
Open CVEs reported against v3.7.2.
See the CVE patch history below for context.
Versions by Severity
CVEs are attributed to tracked releases published before the patch release.
| Version | Published | C | H | M | L | KEV | Notes |
|---|---|---|---|---|---|---|---|
| v3.7.2 | 2026-06-03 | — | — | — | — | — |
Latest
|
| v3.6.18 | 2026-06-03 | — | — | — | — | — |
—
|
| v2.11.47 | 2026-06-03 | — | — | — | — | — |
—
|
| v3.7.1 | 2026-05-11 | — | — | — | — | — |
—
|
| v3.6.17 | 2026-05-11 | — | — | — | — | — |
—
|
| v2.11.46 | 2026-05-11 | — | — | — | — | — |
—
|
| v3.7.0 | 2026-05-05 | — | — | — | — | — |
—
|
| v3.6.16 | 2026-05-05 | — | — | — | — | — |
—
|
| v2.11.45 | 2026-05-05 | — | — | — | — | — |
—
|
| v3.6.15 | 2026-04-29 | — | — | — | — | — |
—
|
| v2.11.44 | 2026-04-29 | — | — | — | — | — |
—
|
| v3.7.0-rc.2 | 2026-04-22 | — | — | — | — | — |
—
|
| v3.6.14 | 2026-04-22 | — | — | — | — | — |
—
|
| v2.11.43 | 2026-04-22 | — | — | — | — | — |
—
|
| v3.6.13 | 2026-04-07 | — | — | — | — | — |
—
|
| v3.7.0-ea.3 | 2026-03-26 | — | — | — | — | — |
Patches
GO-2026-4893
Patches
GO-2026-4897
|
| v3.6.12 | 2026-03-26 | — | — | — | — | — |
Patches
GO-2026-4893
Patches
GO-2026-4897
|
| v2.11.42 | 2026-03-26 | — | — | — | — | — |
Patches
GO-2026-4893
Patches
GO-2026-4897
|
| v3.7.0-ea.2 | 2026-03-19 | — | — | — | — | — |
Patches
GHSA-g3hg-j4jv-cwfr
Patches
GHSA-wvvq-wgcr-9q48
Patches
GO-2026-4792
Patches
GO-2026-4793
Patches
GO-2026-4880
|
| v3.6.11 | 2026-03-19 | — | 1 | — | — | — |
Patches
GHSA-g3hg-j4jv-cwfr
Patches
GHSA-wvvq-wgcr-9q48
Patches
GO-2026-4792
Patches
GO-2026-4793
Patches
GO-2026-4880
|
Trust Signals — 3 of 9 Present
Evidence already collected from releases and repository metadata.
Security Score
A composite score aggregating Scorecard performance, CVE patch history, OpenSSF badge tier, and dependency vulnerability exposure. Score ≥ 7.0 is healthy; < 4.0 warrants attention.
epss
0.25 / 0.5
No EPSS data
freshness
1.00 / 1.0
Up to date
scorecard
2.56 / 4.0
Score 6.4/10
cve health
0.00 / 2.5
Open CVEs detected
patch speed
0.50 / 0.5
0d avg
kev exposure
1.50 / 1.5
No KEV exposure
supply chain risk
0.00 / 10.0
Risk 0.0/100
Score breakdown
schema v2Vulnerability posture
vulnerability posture
0.0
25%
Release responsiveness
release responsiveness
10.0
5%
Dependency exposure
dependency exposure
10.0
10%
Provenance trust
provenance trust
6.4
40%
Maintainer health
maintainer health
10.0
10%
Operational risk
operational risk
8.5
10%
How is this calculated?
The six dimensions group the legacy score signals into weighted categories: direct vulnerability status, patch responsiveness, dependency exposure, provenance checks, maintainer activity, and exploitability risk. The flat component values above remain available for compatibility.
Scorecard
Scorecard 6.4/10OpenSSF Scorecard evaluates supply-chain security practices automatically. Score ≥ 6 is passing; ≥ 8 is excellent.
| Check | Score | Reason |
|---|---|---|
| Maintained | 10 | 30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10 |
| Code-Review | 10 | all changesets reviewed |
| CII-Best-Practices | 0 | no effort to earn an OpenSSF best practices badge detected |
| Security-Policy | 10 | security policy file detected |
| Dangerous-Workflow | 10 | no dangerous workflow patterns detected |
| Token-Permissions | 0 | detected GitHub workflow tokens with excessive permissions |
| Binary-Artifacts | 9 | binaries present in source code |
| License | 10 | license file detected |
| Fuzzing | 0 | project is not fuzzed |
| Branch-Protection | -1 | internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md |
| Signed-Releases | 0 | Project has not signed or included provenance with any releases. |
| Pinned-Dependencies | 5 | dependency not pinned by hash detected -- score normalized to 5 |
| Packaging | 10 | packaging workflow detected |
| SAST | -1 | internal error: internal error: Client.Checks.ListCheckRunsForRef: error during graphqlHandler.setupCheckRuns: Although you appear to have the correct authorization credentials, the `AikidoSec` organization has an IP allow list enabled, and your IP address is not permitted to access this resource. |
OpenSSF Badge
Badge indicates adherence to open-source best practices.
CVE Patch History
Median patch time: 0 daysTracks CVEs that were addressed in tagged releases. Shorter gap between disclosure and patch = faster response. EPSS = predicted probability of exploitation in next 30 days (FIRST.org); colored at ≥90%ile and ≥50%ile.
CVEs Patched by Year
| CVE | Severity | EPSS | Disclosed | Fixed in | Days to fix | vs Ecosystem Median | KEV |
|---|---|---|---|---|---|---|---|
| GO-2026-4893 | unknown | — | — | v3.7.0-ea.3 | — | — | — |
| GO-2026-4897 | unknown | — | — | v3.7.0-ea.3 | — | — | — |
| GO-2026-4893 | unknown | — | — | v3.6.12 | — | — | — |
| GO-2026-4897 | unknown | — | — | v3.6.12 | — | — | — |
| GO-2026-4893 | unknown | — | — | v2.11.42 | — | — | — |
| GO-2026-4897 | unknown | — | — | v2.11.42 | — | — | — |
| GHSA-g3hg-j4jv-cwfr | unknown | — | — | v3.7.0-ea.2 | — | — | — |
| GHSA-wvvq-wgcr-9q48 | High | — | — | v3.7.0-ea.2 | — | — | — |
| GO-2026-4792 | unknown | — | — | v3.7.0-ea.2 | — | — | — |
| GO-2026-4793 | unknown | — | — | v3.7.0-ea.2 | — | — | — |
| GO-2026-4880 | unknown | — | — | v3.7.0-ea.2 | — | — | — |
| GHSA-g3hg-j4jv-cwfr | unknown | — | — | v3.6.11 | — | — | — |
| GHSA-wvvq-wgcr-9q48 | High | — | — | v3.6.11 | — | — | — |
| GO-2026-4792 | unknown | — | — | v3.6.11 | — | — | — |
| GO-2026-4793 | unknown | — | — | v3.6.11 | — | — | — |
| GO-2026-4880 | unknown | — | — | v3.6.11 | — | — | — |
| GHSA-g3hg-j4jv-cwfr | unknown | — | — | v2.11.41 | — | — | — |
| GHSA-wvvq-wgcr-9q48 | High | — | — | v2.11.41 | — | — | — |
| GO-2026-4792 | unknown | — | — | v2.11.41 | — | — | — |
| GO-2026-4793 | unknown | — | — | v2.11.41 | — | — | — |
| GHSA-8q2w-wr49-whqj | unknown | — | — | v3.6.10 | — | — | — |
| GO-2026-4679 | unknown | — | — | v3.6.10 | — | — | — |
| GO-2026-4684 | unknown | — | — | v3.6.10 | — | — | — |
| GO-2026-4684 | unknown | — | — | v2.11.40 | — | — | — |
| GO-2026-4593 | unknown | — | — | v3.6.9 | — | — | — |
| GO-2026-4594 | unknown | — | — | v3.6.9 | — | — | — |
| GO-2026-4597 | unknown | — | — | v3.6.9 | — | — | — |
| GO-2026-4593 | unknown | — | — | v2.11.38 | — | — | — |
| GO-2026-4594 | unknown | — | — | v2.11.38 | — | — | — |
| GO-2026-4597 | unknown | — | — | v2.11.38 | — | — | — |
| GHSA-gv8r-9rw9-9697 | High | — | — | v3.6.8 | — | — | — |
| GO-2026-4484 | unknown | — | — | v3.6.8 | — | — | — |
| GO-2026-4530 | unknown | — | — | v3.6.8 | — | — | — |
| GHSA-gv8r-9rw9-9697 | High | — | — | v2.11.37 | — | — | — |
| GO-2026-4530 | unknown | — | — | v2.11.37 | — | — | — |
KEV = CISA Known Exploited Vulnerabilities catalog — actively exploited in the wild.