发布日期: 2026-06-04
版本号: v3.7.3

Traefik v3.7.3版本发布，主要更新包括：修复了三个安全漏洞（CVE-2026-48020、CVE-2026-48491、CVE-2026-53622）；解决了多个方面的错误，涉及TLS配置计算、TCP路由、日志字段转义、Kubernetes Ingress/Gateway API集成以及文件提供者行为等；同时改进了文档，涵盖了Kubernetes部署、文件提供者参考及迁移指南的更新。建议用户参阅迁移指南以进行升级。

更新内容 （中文）

重要提示： 请阅读迁移指南。

已修复的漏洞：

错误修复：

  • [tls] 应用模型后计算解析后的TLS选项 (#13291 @rtribotte)
  • [webui, tcp] 修复仪表板流程图中TCP路由器服务解析 (#13155 @aliamerj)
  • [k8s/ingress-nginx] 从proxy_set_header头名称中去除引号 (#13203 @crisbal)
  • [accesslogs] 转义带引号日志字段中的双引号 (#13180 @KaanSimsek)
  • [k8s/gatewayapi] 转义精确的gRPC方法匹配 (#13201 @nickmnt)
  • [logs, middleware] 允许从访问日志的RequestPath中丢弃查询参数 (#13091 @calinelson)
  • [k8s/ingress-nginx] 当没有客户端证书时，清除Ssl-Client-*头 (#13260 @gndz07)
  • [k8s/gatewayapi] 升级 github.com/moby/spdystream 至 v0.5.1 (#13252 @kevinpollet)
  • [file] 改进文件提供程序对悬空符号链接的处理 (#12449 @fh-yuxiao-zeng)
  • [server] 升级 github.com/bytedance/sonic 至 v1.15.1 (#13254 @kevinpollet)
  • [middleware, authentication] 当用户列表为空时，在basic auth构建中添加错误 (#13195 @rtribotte)
  • [k8s/ingress] 避免ingress路径匹配器注入并回退11d251415 (#13227 @rtribotte)
  • [server] 将sni检查移至上下文，而非模拟路由 (#13214 @juliens)
  • [middleware] 在StripPrefix和StripPrefixRegex规范化后，拒绝路径不同的请求 (#13215 @rtribotte)
  • [server] 升级 golang.org/x/net 至 v0.55.0 (#13251 @kevinpollet)
  • [k8s/gatewayapi] 更改Kubernetes客户端QPS和突发流量的默认值并公开配置 (#13277 @kevinpollet)
  • [server] 升级 golang.org/x/crypto 至 v0.52.0 (#13276 @rtribotte)

文档：

  • [k8s] 记录Gateway API上图表的新行为 (#13167 @mloiseleur)
  • [file] 替换生成的File路由参考页面 (#13170 @sheddy-traefik)
  • [k8s/crd] 修复accesslogs字段名中的拼写错误 (#13177 @PlayMTL)
  • [k8s/ingress-nginx] 揭示与NGINX共存期间的Ingress状态竞争条件 (#13205 @emilevauge)
  • 润色迁移指南中的语法 (#13174 @quyentonndbs)
  • [middleware] 移除HTML标签中的空格 (#13160 @marbon87)
  • 添加 @LBF38 为当前维护者 (#13225 @emilevauge)
  • 在Kubernetes CRD提供程序迁移指南中添加ingressClassName (#13248 @kevinpollet)
  • [k8s/ingress-nginx] 将 nginx.ingress.kubernetes.io/enable-global-auth 添加到受支持的注解列表中 (#13219 @filip2mac)
  • [k8s/ingress-nginx] 在kubernetesIngressNGINX中将NGINX大写 (#13236 @smellems)

更新内容 （原始）

Important: Please read the migration guide.

CVE fixed:

Bug fixes:

  • [tls] Compute resolved tlsOptions after applying models (#13291 @rtribotte)
  • [webui, tcp] Fix TCP router service resolution in dashboard flow diagram (#13155 @aliamerj)
  • [k8s/ingress-nginx] Trim quotes from proxy_set_header header name (#13203 @crisbal)
  • [accesslogs] Escape double quotes in quoted log fields (#13180 @KaanSimsek)
  • [k8s/gatewayapi] Escape exact gRPC method matches (#13201 @nickmnt)
  • [logs, middleware] Allow query parameters to be dropped from RequestPath in access log (#13091 @calinelson)
  • [k8s/ingress-nginx] Clear Ssl-Client-* headers when no client certificate is present (#13260 @gndz07)
  • [k8s/gatewayapi] Bump github.com/moby/spdystream to v0.5.1 (#13252 @kevinpollet)
  • [file] Improve file provider behavior regarding dangling symlinks (#12449 @fh-yuxiao-zeng)
  • [server] Bump github.com/bytedance/sonic to v1.15.1 (#13254 @kevinpollet)
  • [middleware, authentication] Add error on basic auth build if users is empty (#13195 @rtribotte)
  • [k8s/ingress] Avoid ingress path matcher injection and backport 11d251415 (#13227 @rtribotte)
  • [server] Move snicheck to ctx instead of simulated routing (#13214 @juliens)
  • [middleware] Reject requests with different paths after StripPrefix and StripPrefixRegex normalisation (#13215 @rtribotte)
  • [server] Bump golang.org/x/net to v0.55.0 (#13251 @kevinpollet)
  • [k8s/gatewayapi] Change default values and expose configuration for Kubernetes client QPS and Burst (#13277 @kevinpollet)
  • [server] Bump golang.org/x/crypto to v0.52.0 (#13276 @rtribotte)

Documentation:

  • [k8s] Document new chart behavior on Gateway API (#13167 @mloiseleur)
  • [file] Replace generated File routing reference page (#13170 @sheddy-traefik)
  • [k8s/crd] Fix typo in accesslogs field name (#13177 @PlayMTL)
  • [k8s/ingress-nginx] Surface the Ingress status race condition during NGINX coexistence (#13205 @emilevauge)
  • Polish grammar in migration guides (#13174 @quyentonndbs)
  • [middleware] Remove whitespace in HTML tag (#13160 @marbon87)
  • Add @LBF38 as a current maintainer (#13225 @emilevauge)
  • Add ingressClassName to Kubernetes CRD provider migration guide (#13248 @kevinpollet)
  • [k8s/ingress-nginx] Add nginx.ingress.kubernetes.io/enable-global-auth to the list of supported annotations (#13219 @filip2mac)
  • [k8s/ingress-nginx] Capitalize NGINX in kubernetesIngressNGINX (#13236 @smellems)

下载链接