CVE-2026-54763
published 2026-07-06CVE-2026-54763: Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares strip…
PriorityP259critical10CVSS 3.1
AVNACLPRNUINSCCHIHAN
EPSS
0.21%
10.9th percentile
Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares strip canonical-cased spoofed identity headers before writing Traefik's own value, but do not account for underscore-variant header names, which many backends normalize identically to dashed forms. An attacker able to reach a protected route can inject an underscore-variant header that survives Traefik's stripping and reaches the backend alongside, or on the unauthenticated ForwardAuth authResponseHeaders path instead of, the value Traefik intended to set, spoofing identity or authorization context. This issue is fixed in versions v2.11.51, v3.6.22, and v3.7.6.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devspaces | traefik-rhel9 | — | — |
| github.com | traefik_traefik_v2 | >= 0 < 2.11.51 | 2.11.51 |
| github.com | traefik_traefik_v3 | >= 0 < 3.6.22 | 3.6.22 |
| github.com | traefik_traefik_v3 | >= 3.7.0 < 3.7.6 | 3.7.6 |
| traefik | traefik | < 2.11.51 | 2.11.51 |
| traefik | traefik | — | — |
| traefik | traefik | — | — |
| traefik | traefik | >= 3.0.0 < 3.6.22 | 3.6.22 |
| traefik | traefik | >= 3.7.0 < 3.7.6 | 3.7.6 |
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
nvdv4.07.8HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa8.8HIGH
vendor_redhat10.0CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
traefik: Traefik: Identity spoofing via improper header handling in authentication middlewares
vendor_redhat·2026-07-06·CVSS 10.0
CVE-2026-54763 [CRITICAL] CWE-178 traefik: Traefik: Identity spoofing via improper header handling in authentication middlewares
traefik: Traefik: Identity spoofing via improper header handling in authentication middlewares
Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares strip canonical-cased spoofed identity headers before writing Traefik's own value, but do not account for underscore-variant header names, which many backends normalize identically to dashed forms. An attacker able to reach a protected route can inject an underscore-variant header that survives Traefik's stripping and reaches the backend alongside, or on the unauthenticated ForwardAuth authResponseHeaders path instead of, the value Traefik intended to set, spoofing identity or authorization context. This issue is fixed in versions v2.11.51, v3.6
GHSA
Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
ghsa·2026-08-06·CVSS 8.8
CVE-2026-54763 [HIGH] CWE-178 Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
## Summary
There is a high severity vulnerability in Traefik's BasicAuth, DigestAuth, and ForwardAuth
middlewares. The fix for CVE-2026-33433 stripped canonical-cased spoofed identity headers
(e.g. `X-Auth-User`) before writing Traefik's own value, but did not account for
underscore-variant header names (e.g. `X_Auth_User`), which many backends normalize
identically to the dashed form. An attacker able to reach a protected route could inject
an underscore-variant header that survives Traefik's stripping and reaches the backend
alongside — or, on the unauthenticated ForwardAuth `authResponseHeaders` path, instead of
— the value
VulDB
Traefik up to 2.11.50/3.6.21/3.7.5 BasicAuth/DigestAuth/ForwardAuth improper authorization
vuldb·2026-07-06·CVSS 7.8
CVE-2026-54763 [HIGH] Traefik up to 2.11.50/3.6.21/3.7.5 BasicAuth/DigestAuth/ForwardAuth improper authorization
A vulnerability marked as critical has been reported in Traefik up to 2.11.50/3.6.21/3.7.5. Affected by this vulnerability is an unknown functionality of the component BasicAuth/DigestAuth/ForwardAuth. The manipulation leads to improper authorization.
This vulnerability is documented as CVE-2026-54763. The attack can be initiated remotely. There is not any exploit available.
No detection rules found.
No public exploits indexed.
2026-07-06
Published