CVE-2026-54763
published 2026-07-06CVE-2026-54763: Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares strip…
PriorityP260critical10CVSS 3.1
AVNACLPRNUINSCCHIHAN
EPSS
0.24%
14.2th percentile
Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares strip canonical-cased spoofed identity headers before writing Traefik's own value, but do not account for underscore-variant header names, which many backends normalize identically to dashed forms. An attacker able to reach a protected route can inject an underscore-variant header that survives Traefik's stripping and reaches the backend alongside, or on the unauthenticated ForwardAuth authResponseHeaders path instead of, the value Traefik intended to set, spoofing identity or authorization context. This issue is fixed in versions v2.11.51, v3.6.22, and v3.7.6.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devspaces | traefik-rhel9 | — | — |
| github.com | traefik_traefik_v2 | >= 0 < 2.11.51 | 2.11.51 |
| github.com | traefik_traefik_v3 | >= 0 < 3.6.22 | 3.6.22 |
| github.com | traefik_traefik_v3 | >= 3.2.0 < 3.7.13 | 3.7.13 |
| github.com | traefik_traefik_v3 | >= 3.7.0 < 3.7.6 | 3.7.6 |
| traefik | traefik | < 2.11.51 | 2.11.51 |
| traefik | traefik | — | — |
| traefik | traefik | — | — |
| traefik | traefik | >= 3.0.0 < 3.6.22 | 3.6.22 |
| traefik | traefik | >= 3.7.0 < 3.7.6 | 3.7.6 |
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
nvdv4.07.8HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa8.8HIGH
vendor_redhat10.0CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
traefik: Traefik: Identity spoofing via improper header handling in authentication middlewares
vendor_redhat·2026-07-06·CVSS 10.0
CVE-2026-54763 [CRITICAL] CWE-178 traefik: Traefik: Identity spoofing via improper header handling in authentication middlewares
traefik: Traefik: Identity spoofing via improper header handling in authentication middlewares
Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares strip canonical-cased spoofed identity headers before writing Traefik's own value, but do not account for underscore-variant header names, which many backends normalize identically to dashed forms. An attacker able to reach a protected route can inject an underscore-variant header that survives Traefik's stripping and reaches the backend alongside, or on the unauthenticated ForwardAuth authResponseHeaders path instead of, the value Traefik intended to set, spoofing identity or authorization context. This issue is fixed in versions v2.11.51, v3.6
GHSA
Traefik entrypoint header-name sanitization bypassed via request trailers
ghsa·2026-09-10
CVE-2026-88004 [HIGH] CWE-436 Traefik entrypoint header-name sanitization bypassed via request trailers
Traefik entrypoint header-name sanitization bypassed via request trailers
## Summary
Traefik's entrypoint defenses against spoofed trusted header names — `aliasHeadersStrategy` / `underscoreHeadersStrategy` in `delete` or `reject` mode, and the default `forwardedHeaders` stripping of client-supplied `X-Forwarded-*` — scan `req.Header` only and never `req.Trailer`. An unauthenticated client can therefore smuggle a sanitized name (an aliasing spelling such as `X_Auth_User`, or a trusted name such as `X-Forwarded-Prefix`) as an HTTP/1.1 chunked trailer or an HTTP/2 trailer: `reject` does not return its documented `400`, `delete` does not remove the name, and Traefik's reverse proxy forwarded the trailer to the backend — with an attacker-chosen value whenever a body-buffering middleware (the
GHSA
Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
ghsa·2026-08-06·CVSS 8.8
CVE-2026-54763 [HIGH] CWE-178 Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
## Summary
There is a high severity vulnerability in Traefik's BasicAuth, DigestAuth, and ForwardAuth
middlewares. The fix for CVE-2026-33433 stripped canonical-cased spoofed identity headers
(e.g. `X-Auth-User`) before writing Traefik's own value, but did not account for
underscore-variant header names (e.g. `X_Auth_User`), which many backends normalize
identically to the dashed form. An attacker able to reach a protected route could inject
an underscore-variant header that survives Traefik's stripping and reaches the backend
alongside — or, on the unauthenticated ForwardAuth `authResponseHeaders` path, instead of
— the value
VulDB
Traefik up to 2.11.50/3.6.21/3.7.5 BasicAuth/DigestAuth/ForwardAuth improper authorization
vuldb·2026-07-06·CVSS 7.8
CVE-2026-54763 [HIGH] Traefik up to 2.11.50/3.6.21/3.7.5 BasicAuth/DigestAuth/ForwardAuth improper authorization
A vulnerability marked as critical has been reported in Traefik up to 2.11.50/3.6.21/3.7.5. Affected by this vulnerability is an unknown functionality of the component BasicAuth/DigestAuth/ForwardAuth. The manipulation leads to improper authorization.
This vulnerability is documented as CVE-2026-54763. The attack can be initiated remotely. There is not any exploit available.
No detection rules found.
No public exploits indexed.
2026-07-06
Published