CVE-2026-35051
published 2026-04-30CVE-2026-35051: Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is an authentication bypass vulnerability in…
PriorityP266critical10CVSS 3.1
AVNACLPRNUINSCCHIHAN
EPSS
0.27%
18.3th percentile
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is an authentication bypass vulnerability in Traefik's ForwardAuth middleware when trustForwardHeader=false is configured and Traefik is deployed behind a trusted upstream proxy. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devspaces | traefik-rhel9 | — | — |
| github.com | traefik_traefik | 0 – 1.7.34 | — |
| github.com | traefik_traefik_v2 | >= 0 < 2.11.43 | 2.11.43 |
| github.com | traefik_traefik_v3 | >= 3.0.0-beta1 < 3.6.14 | 3.6.14 |
| github.com | traefik_traefik_v3 | >= 3.7.0-ea.1 < 3.7.0-rc.2 | 3.7.0-rc.2 |
| traefik | traefik | < 2.11.43 | 2.11.43 |
| traefik | traefik | — | — |
| traefik | traefik | — | — |
| traefik | traefik | — | — |
| traefik | traefik | — | — |
| traefik | traefik | — | — |
| traefik | traefik | — | — |
| traefik | traefik | >= 3.0.0 < 3.6.14 | 3.6.14 |
Detection & IOCsextracted from sources · hover to see the quote
- →Authentication bypass is triggered when ForwardAuth middleware has trustForwardHeader=false and Traefik is deployed behind a trusted upstream proxy — monitor for unexpected authenticated access to ForwardAuth-protected routes in this configuration ↗
- →Look for unauthorized access to resources protected by ForwardAuth middleware, particularly from remote sources, which may indicate exploitation of this bypass ↗
- ·Vulnerable configuration: ForwardAuth middleware with trustForwardHeader explicitly set to false while Traefik is deployed behind a trusted upstream proxy. Patched versions are 2.11.43, 3.6.14, and 3.7.0-rc.2. ↗
- ·Mitigation: Do not explicitly set trustForwardHeader=false when Traefik is behind a trusted upstream proxy; set it to true or omit it. A service restart/reload is required after config change. ↗
- ·Red Hat OpenShift Dev Spaces package devspaces/traefik-rhel9 is confirmed affected. ↗
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
nvdv4.07.8HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Traefik up to 2.11.42/3.6.13/3.7.0-rc.1 data authenticity
vuldb·2026-04-30·CVSS 7.8
CVE-2026-35051 [HIGH] Traefik up to 2.11.42/3.6.13/3.7.0-rc.1 data authenticity
A vulnerability identified as critical has been detected in Traefik up to 2.11.42/3.6.13/3.7.0-rc.1. Affected by this issue is some unknown functionality. The manipulation leads to insufficient verification of data authenticity.
This vulnerability is listed as CVE-2026-35051. The attack may be initiated remotely. There is no available exploit.
You should upgrade the affected component.
GHSA
Traefik's ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass authentication
ghsa·2026-04-24
CVE-2026-35051 [HIGH] CWE-345 Traefik's ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass authentication
Traefik's ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass authentication
## Summary
There is a high-severity authentication bypass vulnerability in Traefik's `ForwardAuth` middleware when `trustForwardHeader=false` is configured and Traefik is deployed behind a trusted upstream proxy.
While `X-Forwarded-*` headers (such as `X-Forwarded-For`, `X-Forwarded-Host`, and `X-Forwarded-Proto`) from trusted context are correctly rebuilt, it does not strip or rebuild `X-Forwarded-Prefix`, leaving any attacker-supplied value intact in the subrequest forwarded to the authentication service.
When the authentication service makes authorization decisions based on `X-Forwarded-Prefix`, an external attacker can spoof a trusted prefix value and gain unauthorized access t
Red Hat
Traefik: github.com/traefik/traefik: Traefik: Authentication bypass in ForwardAuth middleware
vendor_redhat·2026-04-30·CVSS 7.8
CVE-2026-35051 [HIGH] CWE-501 Traefik: github.com/traefik/traefik: Traefik: Authentication bypass in ForwardAuth middleware
Traefik: github.com/traefik/traefik: Traefik: Authentication bypass in ForwardAuth middleware
A flaw was found in Traefik, an HTTP reverse proxy and load balancer. This authentication bypass vulnerability exists in Traefik's ForwardAuth middleware when the `trustForwardHeader` setting is configured as `false` and Traefik is deployed behind a trusted upstream proxy. A remote attacker could exploit this to bypass authentication, potentially gaining unauthorized access to protected resources.
Mitigation: To mitigate this issue, ensure that the `trustForwardHeader` setting in Traefik's ForwardAuth middleware is not explicitly configured as `false` unless absolutely necessary. If Traefik is deployed behind a trusted upstream proxy, review the configuration to ensure that `trustForwardHeader`
No detection rules found.
No public exploits indexed.
https://github.com/traefik/traefik/releases/tag/v2.11.43https://github.com/traefik/traefik/releases/tag/v3.6.14https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2https://github.com/traefik/traefik/security/advisories/GHSA-6384-m2mw-rf54https://access.redhat.com/errata/RHSA-2026:21772https://access.redhat.com/security/cve/CVE-2026-35051https://bugzilla.redhat.com/show_bug.cgi?id=2464235https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35051.json
2026-04-30
Published