Traefik hat eine mögliche Schwachstelle mit den Pfadabgleichern in github.com/traefik/traefik

The vulnerability lies in how Traefik handles path matching rules. An attacker could potentially craft malicious requests that bypass intended access controls, gaining access to protected resources or functionalities. The exact impact depends on the specific configuration of Traefik and the services it proxies. While the specific attack vector isn't detailed, the potential for unauthorized access warrants immediate attention. This could lead to data breaches, service disruption, or even complete compromise of the underlying infrastructure.

Organizations utilizing Traefik as a reverse proxy or load balancer, particularly those with complex routing configurations or exposed internal services, are at risk. Environments relying on Traefik for critical infrastructure or sensitive data are especially vulnerable.

• linux / server:

journalctl -u traefik -f | grep -i "path matcher"

• generic web:

curl -I <traefik_endpoint> | grep -i "traefik"

1. 2025-04-22Disclosure

   disclosure

1. Reserviert2025-04-08
2. Veröffentlicht2025-04-22
3. Geändert2026-03-03
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-32431 is to upgrade Traefik to version 2.11.24 or later. This version includes a fix that addresses the path matching vulnerability. If an immediate upgrade is not feasible, consider reviewing and tightening your Traefik configuration, particularly the path matching rules. Ensure that rules are as specific as possible to minimize the attack surface. While a WAF might offer some protection, it's not a substitute for patching. Monitor Traefik logs for unusual patterns or requests that might indicate exploitation attempts.