Traefik v3.7.3 Released with Critical CVE Fixes

Traefik v3.7.3 Released: Security Fixes & Bug Squashes

The Traefik team has released v3.7.3, a patch that addresses three CVEs and resolves several bugs. Users are strongly encouraged to upgrade and consult the migration guide before updating.

Security Fixes

Three vulnerabilities are patched:

CVE-2026-48020 (GHSA-xf64-8mw2-4gr2)
CVE-2026-48491 (GHSA-5r4w-85f3-pw66)
CVE-2026-53622 (GHSA-9cr8-q42q-g8m7)

Bug Fixes

Key fixes in this release include:

TLS options: Models now correctly apply after loading (#13291)
WebUI dashboard: Flow diagram shows TCP router services properly (#13155)
Kubernetes ingress-nginx:
- Quotes trimmed from proxy_set_header header names (#13203)
- Ssl-Client-* headers cleared when no client certificate is present (#13260)
Access logs:
- Double quotes in quoted fields are now escaped (#13180)
- Query parameters can be dropped from RequestPath (#13091)
gRPC: Exact matches trimmed for Gateway API (#13201)
File provider: Better handling of dangling symlinks (#12449)
Basic auth: Error added when users list is empty (#13195)

Action Required

Update to v3.7.3 to mitigate security risks and improve reliability in Kubernetes and TCP routing scenarios.
Pay special attention to TLS configuration and access log formatting if customized.

Source: https://github.com/traefik/traefik/releases/tag/v3.7.3