Fabio CVE-2026-62987

Exploitable only when the operator has configured one or more of the proxy.header options - ClientIPHeader, TLSHeader, or RequestID - which are EMPTY BY DEFAULT, meaning default Fabio installations are NOT affected. When set, an unauthenticated remote client simply lists the configured header name in the inbound HTTP Connection header, and Go's ReverseProxy honors it and strips the header before the request reaches the backend. Impact only materializes if a backend actually relies on those Fabio-injected headers for authorization decisions or audit logging. The hardcoded forwarded-header allowlist (X-Forwarded-*, Forwarded, X-Real-Ip, X-Request-Id, X-Client-Ip) is unaffected, so this only breaks operator-renamed custom trust headers.

This is a genuine but low-priority integrity issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N = 5.8 Medium) correctly reflects a network, unauthenticated, low-complexity attack with only limited integrity impact and a scope change (the harm lands on the backend, a separate trust authority, not on Fabio itself). There is NO confidentiality or availability impact - this is not RCE or data theft; it is the silent removal of trust-signal headers. Critically, the description states the affected proxy.header options (ClientIPHeader, TLSHeader, RequestID) are EMPTY BY DEFAULT, so default deployments are unaffected - the PR:N rating reflects protocol-level access but the real precondition is a non-default operator configuration, which the raw score does not capture. No EPSS score, KEV listing, or public POC was provided; per precision rules this is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. This is an incomplete-fix follow-up to CVE-2025-48865, which raises some regression concern, but real-world urgency is bounded by the non-default config requirement and the fact that impact is loss of audit/authz signals rather than a direct bypass in every deployment.

An operator runs Fabio (1.6.6-1.7.1) configured to inject a client-IP, TLS-termination, or request-ID header that backends trust for authorization or audit logging. An unauthenticated remote client sends a request with Connection: X-Client-Ip (or the configured header name), causing Go's ReverseProxy to strip that trust header before the request reaches the backend, so the backend sees no client IP / no TLS signal / no request-correlation ID and may misjudge authorization or lose audit trail. No public exploit code was identified at time of analysis.