Repository navigation
fix(plex): keep Plex tokens out of the Traefik access log - #3153
Merged
Merged
Conversation
Plex clients send X-Plex-Token in the query string, and the Traefik access log keeps the full request path. Turn off access logging for the plex router only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
🛡️ Trivy image scan — fixable HIGH/CRITICAL vulnerabilities foundThe images below have known vulnerabilities with fixes available. Update to a patched image (digest) before merging.
|
| CVE | Package | Installed | Fixed | Severity |
|---|---|---|---|---|
| CVE-2026-111943 | stdlib | v1.27.1 | 1.26.10, 1.27.3 | HIGH |
| CVE-2026-78667 | stdlib | v1.27.1 | 1.26.9, 1.27.2 | HIGH |
| CVE-2026-78669 | stdlib | v1.27.1 | 1.26.9, 1.27.2 | HIGH |
| CVE-2026-92392 | curl | 8.18.0-1ubuntu2.7 | 8.18.0-1ubuntu2.8 | HIGH |
| CVE-2026-92392 | libcurl4t64 | 8.18.0-1ubuntu2.7 | 8.18.0-1ubuntu2.8 | HIGH |
| CVE-2026-97031 | stdlib | v1.27.1 | 1.26.9, 1.27.2 | HIGH |
MichielMak
enabled auto-merge (squash)
October 25, 2026 22:48
MichielMak
approved these changes
Oct 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Plex clients send their token as
X-Plex-Tokenin the query string. Traefik's access log (--accesslog=true, all fields kept) logs the full request path, so every Plex request wrote a token to the Traefik logs.What changed
Added
traefik.http.routers.plex.observability.accesslogs=falseto the plex router (Traefik v3.1+). Only Plex loses its access log lines. Other services keep theirs.After merging
plex(labels changed), so Plex restarts briefly.plexrequests.PLEX_TOKENin the SOPS files that use it (plex,kometa,plex-auto-languages) and deploy those stacks by hand.Remaining risk
cloudflared still logs the full URL of failed requests (
ERR Request failed), so a Plex token can still end up there when a request through the tunnel fails. cloudflared can't filter that.🤖 Generated with Claude Code