Is there a public PoC exploit available for CVE-2026-54764?

Yes, a public proof-of-concept exploit is available for CVE-2026-54764. Prioritise patching immediately. EPSS: 0.4%.

Is there a patch available for CVE-2026-54764?

Yes, a patch is available for CVE-2026-54764. Update the affected software to the latest version immediately.

Traefik CVE-2026-54764

Q: What is the CVSS score of CVE-2026-54764?

CVE-2026-54764 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-41937 MEDIUM

Insufficient Verification of Data Authenticity (CWE-345)

2026-07-06 GitHub_M

GHSA-3q9r-p662-5j8m

Authentication Bypass Traefik Red Hat Suse

6.9

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.8 MEDIUM

Network-reachable with no prerequisites; scope changes because the integrity impact lands on the downstream auth service, not Traefik itself.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

SUSE

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Red Hat

5.8 MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 06, 2026 - 22:08 vuln.today

Patch available

Jul 06, 2026 - 22:02 EUVD

DescriptionCVE.org

Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's ForwardAuth middleware, even when configured with trustForwardHeader: false, derives the X-Forwarded-Port header sent to the authentication service from the original incoming request instead of the sanitized forwarded request. As a result, an unauthenticated remote attacker can inject an X-Forwarded-Proto: https header over a plain HTTP connection and cause Traefik to forward X-Forwarded-Port: 443 to the authentication service, bypassing port-based authorization checks. This issue is fixed in versions v2.11.51, v3.6.22, and v3.7.6.

AnalysisAI

Header injection in Traefik's ForwardAuth middleware allows unauthenticated remote attackers to manipulate the X-Forwarded-Port value sent to authentication backends, enabling bypass of port-based authorization checks. Affected are all Traefik v2.x prior to v2.11.51, v3.6.x from 3.0.0 prior to v3.6.22, and v3.7.x from 3.7.0 prior to v3.7.6. The flaw persists even when the trustForwardHeader: false safeguard is active, because the port derivation logic reads the original incoming request rather than the sanitized forwarded context. No public exploit code has been identified at time of analysis, and vendor-released patches are available.

Technical ContextAI

Traefik is a cloud-native HTTP reverse proxy and load balancer widely used in Docker and Kubernetes environments. Its ForwardAuth middleware delegates authentication and authorization decisions to an external service by forwarding request context headers. The trustForwardHeader: false setting is designed to prevent untrusted upstream headers from influencing these decisions. However, a code-level defect causes X-Forwarded-Port - the header informing the auth service of the originating port - to be derived from the raw incoming request rather than the sanitized forwarded request. CWE-345 (Insufficient Verification of Data Authenticity) precisely describes this root cause: Traefik fails to verify that the port header value originates from a trustworthy, controlled source before relaying it to a downstream decision-maker. CPE cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:* covers all versions. The fix was implemented in commit 7ae92d8c2c10ac04ef5a03df0ed5019ce0f44b2d and tracked in pull request #13344.

RemediationAI

Upgrade to Traefik v2.11.51, v3.6.22, or v3.7.6 depending on your deployment branch; these are the vendor-confirmed fixed releases per GHSA-3q9r-p662-5j8m. The underlying code fix is in commit 7ae92d8c2c10ac04ef5a03df0ed5019ce0f44b2d (https://github.com/traefik/traefik/commit/7ae92d8c2c10ac04ef5a03df0ed5019ce0f44b2d). If immediate patching is not feasible, the most actionable compensating control is to configure any upstream ingress or load balancer to strip the X-Forwarded-Proto header before requests reach Traefik, preventing injection - note this may interfere with legitimate HTTPS protocol signaling and should be tested. Alternatively, audit ForwardAuth backend logic to ensure authorization decisions are not solely driven by X-Forwarded-Port values; removing port-based policy branching eliminates the exploitable condition without requiring a Traefik version change, though this is a logic change not a security patch. There is no known workaround that preserves full ForwardAuth functionality while blocking the injection.