Traefik 3.7.14

Traefik 3.7.14 arrived on October 6, 2026, and the patch number is misleading. The release notes lead with an important notice that points readers at a migration guide, which is not what you expect from a routine patch. Then the change list closes eight separate security advisories. Eight CVEs in a single patch release is a strong signal that something in the 3.7 line needed fixing quickly.

The Security Picture

Start here if you run Traefik anywhere reachable from the public internet. This release fixes GHSA-53qr-784g-cj35, GHSA-cw35-4q88-3rmp, GHSA-fh26-gfpp-7xxx, GHSA-mwrr-6hp4-pxr6, GHSA-qm9f-w54v-q2qh, GHSA-qvj7-gq9c-hp7q, GHSA-rv2h-qh7j-xrjw and GHSA-mhjw-hmjv-p99x. That is a long list for a point release, and the maintainers also bump golang.org/x/crypto to v0.57.0 and the ACME library go-acme/lego to v5.5.2.

The migration link in the release header is worth opening before you deploy. Traefik patches rarely require migration reading, so the fact that this one does deserves attention rather than a blind image tag bump.

Kubernetes Providers Get The Bulk Of The Fixes

Most of the non security work lands in the Kubernetes providers, and it is the kind of cleanup that only shows up once you run enough objects to hit the edge cases.

• Gateway API router shadowing - routers that a previous object shadowed are no longer created, TLSRoute routers no longer shadow TCPRoute routers, and TLSRoute router names no longer collide across listeners that share an entry point.
• Gateway API correctness - the HTTP and GRPC route conflict is fixed, Gateways are sorted stably so the TLS certificate order stays predictable, and the BackendTLSPolicy ancestor is reported in the namespace of its Gateway.
• ingress-nginx provider - ssl-passthrough routes are built like any other ingress, resource names are no longer normalized, trailing capture groups in ImplementationSpecific paths are optional, and wildcard origins now work in cors-allow-origin.
• Auth handling - the Authorization header is removed for basic and digest auth, and the Ssl-Client request headers are set on the Ingress-NGINX HTTP router.

On The Data Plane

FastProxy gets one change that matters: NTLM and Negotiate backend connections are now isolated, and preauthenticated NTLM and Kerberos backend connections are kept separate in the service layer. The P2C load balancer also loses a long standing second server selection bias, and sticky transports are now dedicated per ServersTransport instead of being shared.

Smaller items round out the list. Negated matchers are ignored when parsing rule domains, IngressRoute metadata can finally show up in access logs, the rate limiter Lua script stops using the deprecated table.maxn, and the encoded characters warning is silenced when some characters are disallowed. OpenTelemetry exporters move to v1.46.0 for metrics and traces.

The Skeptical Take

Let us not pretend this is a feature release, because it is not. There are no new capabilities here, the migration guide exists for a reason, and the eight CVEs mean the previous 3.7 builds carried real exposure. If you pinned 3.7.11 or earlier and planned to wait for a calmer window, that window is now.

The caveat is the usual one for fast moving patches: you are trading one set of unknowns for another, and the Kubernetes provider rework touches router naming, so teams with hand written dashboards or alerts keyed on generated router names should check their labels after rollout. Everything else is drop in. Run it in staging first, watch your access logs, then promote.