Traefik 3.6 ended August 16, 2026 —
the first Traefik minor that didn’t die overnight.

Traefik 3.6 reached end of security support on August 16, 2026 — the day this piece was published. Its active support had already ended on May 7; what stopped on August 16 was the last thing still flowing: security fixes.

The date itself is routine. What is not routine is that 3.6 got a date at all. Every previous Traefik 3.x minor died the day its successor shipped — no security tail, no overlap, no grace. The average lifespan of a 3.x minor under that regime was 93 days. Traefik changed its policy with 3.6, and today is the first time the new rules actually retire a release.

What stopped on August 16

Traefik 3.6 shipped on November 7, 2025. Active support — features and bug fixes — ended on May 7, 2026, and the release ran on security backports until August 16, 2026. The 3.6 version page lists the latest build and its date. Traefik’s release table shows security support for 3.6 as ended on August 16, 2026; no 3.6 release has been published since, and nothing commits Traefik to another.

Context matters for what this software is: Traefik is an ingress controller and reverse proxy, sitting at the network edge of a very large number of Kubernetes clusters and Docker hosts — the component that terminates TLS and touches every inbound request before your applications do. An unpatched ingress controller is not a dependency problem buried in a lockfile; it is the front door.

The 93-day treadmill nobody noticed

Here is the part of Traefik’s lifecycle most teams have never looked at. Until version 3.6, Traefik’s own policy was that only the latest minor was supported at any moment — the instant a new minor shipped, the previous one stopped receiving anything, including security fixes. Measured across the six 3.x minors retired under that rule:

Seventy days. Seventy-seven. Seventy-nine. The v2 line ran the same treadmill — 2.7 lasted 36 days. If your patching cadence for edge infrastructure is quarterly, it was mathematically impossible to stay on a supported Traefik under the old policy without upgrading nearly every cycle. Most teams never noticed, because nothing announces that an ingress controller has silently left support — which is precisely the blind spot this site exists to close.

The policy that changed with 3.6 — and what it means for v2

Traefik’s release documentation now states: “Every minor is supported for 6 months from its GA release date, which means several minor versions can be supported at the same time” — and, explicitly: “These rules apply starting with Traefik v3.6. Before that, only the latest minor was on active support at any given time, and support for a minor ended as soon as the next one was released.”

So 3.6 is the first Traefik minor in history with a separate security window — roughly three months of fixes after 3.7 took over active support. That is a real improvement, and it is also a shorter runway than it sounds: six months per minor is still one of the fastest support cadences of any widely deployed infrastructure component. For comparison, the same class of software elsewhere measures support in years.

The policy has a second clause with a bigger blast radius: “The last minor after releasing a new major is supported for 2 years following the major release.” That clause is what governed Traefik v2 — and the date on Traefik’s release table has passed. Traefik 2.11, the final v2 release, lost security support on September 7, 2026 — a deadline Traefik’s published release table extended from the originally announced February 1, 2026. The v2 install base is enormous and migration to v3 involves real configuration changes, which is exactly the combination that leaves fleets parked on a dying major. If you are on any 2.x today, the extension bought you months, not years; the table date has passed, and the 2.11 releases since then are not a commitment — 35 is 2.11’s current risk score, and it only rises from here.

What to do

If you are on 3.6: move to 3.7. It is the only Traefik release line still receiving security fixes, and within the 3.x line the upgrade is routine. Traefik has not published an end date for 3.7; under the 6-month policy, expect the next minor around November 2026 — and budget for that cadence permanently.

If you are on 3.0–3.5: you have been out of support since the day the next minor shipped — for 3.5 that was November 7, 2025. Same move, more urgency: 3.7, now.

If you are on v2: the migration to v3 is a project, not a patch — static configuration, rule syntax and middleware names all changed — but the alternative is an internet-facing proxy on a line whose security support, by Traefik’s release table, ended in September 2026. Traefik has still published six more 2.11 releases since (2.11.58 to 2.11.63, October and November 2026, four of them listing CVE fixes), but nothing commits it to another. Start with Traefik’s v2-to-v3 migration guide, and treat every week since then as the schedule pressure it is.

If you cannot move now: the standard compensations apply with edge-component force: restrict who can reach the dashboard and API, pin provider permissions to least privilege, and record the decision with a date. An end-of-life ingress controller is the first thing a scanner finds and the last thing anyone remembers deploying.

Every Traefik release line, its dates and its EOL Risk Score are on the Traefik lifecycle page, updated at every build from upstream data.

Frequently Asked Questions