Security at Traefik Labs

This page covers how we handle a security vulnerability: what happens to a report, how advisories are published, which versions receive fixes, and how to report something you have found. It applies to every Traefik Labs product, open source and commercial.

How a report is handled

Reports arrive privately and stay private until a fix is available. We reproduce a finding before accepting it, rather than triaging on the description alone, and we say so on the thread either way. Reports we decline are answered with the specific published position they rest on, not a form letter.

When a report is accepted, the fix ships first and the advisory is published with it. Each advisory carries the affected version ranges, a CVSS v4 vector, the mitigation where one exists, and credit to the reporter.

What we treat as a vulnerability is published, and so is the record of the positions we have already settled:

• Security policy and threat model: what Traefik trusts, what crosses the security boundary, and the submission requirements.
• Security decisions: the positions already settled, grouped by the surface a report touches, each naming the neighbouring variant that is a vulnerability, with the advisories that prove it.

Published advisories

Every advisory we publish is a GitHub Security Advisory on traefik/traefik, readable without an account. CVE identifiers for Traefik are assigned through GitHub as a CVE Numbering Authority, and appear on the advisory once assigned.

Which versions still receive security fixes, with their active support and security support end dates, is maintained on the Releases page. Machine-readable contact information is at /.well-known/security.txt.

Report a vulnerability

Read the policy and the decisions above first. The report we receive most often is a decision we have already published, so checking takes a few minutes and saves a round trip. Three requirements come from the policy:

• A working proof of concept with reproduction steps. Validate the finding yourself against a current release first.
• One finding per report. Bundling forces a single decision onto claims that deserve different answers.
• Disclose your use of AI tooling. Using an AI assistant is acceptable and saying so is required. Unvalidated AI-generated reports are closed immediately.

Open a private security advisory on the Traefik repository, never a public issue. This covers Traefik Proxy and Traefik Hub: Hub is developed in a private repository, so Hub findings go to the same place, and the report should say that it concerns Hub and which component.