Traefik v3.7.11 released on 19-08-2026
Traefik v3.7.11 is out now. It tightens Kubernetes CRD scoping and service naming to avoid generated-name collisions, improves Gateway API and Ingress behaviour for more predictable routing, and applies several protocol and TLS hardenings.
See the Traefik GitHub releases page and the project documentation for full details, migration guidance and configuration options.
What’s in this release
- Kubernetes CRD provider: safe naming to prevent generated-name collisions; generated Service names are now scoped to their parent CRD and failover services are named after the referenced Service; plus an option to restrict the namespace used for default TLS resources.
- Gateway API, Ingress and ingress-nginx fixes: Gateway API URLRewrite/RequestRedirect now preserve encoded path segments and router rules were corrected; ingress-nginx deduplicates client-auth TLS options across ingresses sharing a host, applies auth/custom-headers/custom-errors/ssl-redirect to the ingress default backend, and respects asDefault and internal entrypoint exclusions; Kubernetes Ingress service middleware now enforces crossProviderNamespace.
- FastProxy, HTTP/3, middleware and TLS tweaks: FastProxy rejects out-of-range backend status codes; quic-go bumped to v0.61.0 for HTTP/3; authentication middleware and golang.org/x dependencies updated; new option to disable fallback to default TLS options and documentation clarifying TLS option conflict resolution and router vs entrypoint TLS behaviour.
Upgrade notes
- Check the updated version support policy (effective from v3.6), the Gateway API 1.6.1 migration guidance and the Experimental Channel CRD requirements for the Kubernetes Gateway provider before upgrading.
- Rollback: the release notes do not list any special rollback steps.
Share your experience with the upgrade or report any issues on the Traefik GitHub trackers so others can benefit from your notes.
