The traefik project releases a new version addressing multiple vulnerabilities:
- GHSA-53qr-784g-cj35 (FastProxy backend connection pool leaks identity)
- GHSA-cw35-4q88-3rmp (NTLM/Kerberos sticky round tripper is not keyed by service)
- GHSA-fh26-gfpp-7xxx (snicheck skips the check when `req.TLS` is nil)
- GHSA-mwrr-6hp4-pxr6 (Ingress-NGINX provider forwards forged Ssl-Client-* identity headers
- GHSA-qm9f-w54v-q2qh (Preauthenticated Negotiate contaminates Traefik's backend connection pool
- GHSA-qvj7-gq9c-hp7q (ssl-passthrough sibling HTTP router serves the auth-protected backend without auth)
- GHSA-rv2h-qh7j-xrjw (colliding auth-tls-secret names merge two client CAs into one TLS option)
- GHSA-mhjw-hmjv-p99x (Unsynchroinized write to sticky round tripper shared by concurrent HTTP/2 streams)