EUVD-2026-16616
GHSA-qr99-7898-vr7c
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Anti-spoofing controls
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While CVSS and EPSS scores were not provided in the intelligence data, the vulnerability carries moderate-to-high real-world risk based on structural analysis. The attack requires prior authentication (limiting exposure to insider threats and users with legitimate access), but the impact-arbitrary identity spoofing to backend systems-is critical in zero-trust and microservices architectures where Traefik acts as a security boundary. The exploitability is high: no complex attack chain is needed, the condition (non-canonical header configuration) is passive and common in deployments, and HTTP header injection is well-understood. The patch availability across all three major version lines (2.x, 3.6.x, 3.7.x-ea) is a positive signal, indicating vendor responsiveness. However, the authentication requirement reduces the threat to externally-facing deployments; internal network attacks exploiting this are the primary concern. Absence of public POC or CISA KEV confirmation suggests this is a responsibly-disclosed vulnerability without widespread active exploitation at publication. |
| Exploit ScenarioDerived | An authenticated user with legitimate access to a web application fronted by Traefik makes a request with a manually-crafted canonical HTTP header (e.g., |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 27, 2026
Traefik reverse proxy and load balancer versions prior to 2.11.42, 3.6.11, and 3.7.0-ea.3 allow authenticated attackers to inject canonical HTTP header names that override non-canonical headers configured via the headerField setting, enabling identity impersonation to backend systems. The vulnerability exploits HTTP header handling inconsistencies where backends read the attacker-supplied canonical header before Traefik's non-canonical configuration, permitting authentication bypass for any identity. Vendor-released patches are available for all affected major versions.
RemediationAI
Upgrade Traefik to version 2.11.42, 3.6.11, or 3.7.0-ea.3 or later depending on the major version in use (see https://github.com/traefik/traefik/releases/tag/v2.11.42, https://github.com/traefik/traefik/releases/tag/v3.6.11, and https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.3). Until patching is feasible, audit all headerField configurations to ensure canonical HTTP header naming (e.g., X-Auth-User instead of x-auth-user) to reduce the surface for header injection; additionally, configure backend systems to reject or sanitize duplicate headers and implement strict input validation on authentication headers. Network segmentation limiting authenticated user access to Traefik instances is also recommended as a compensating control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 6 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Traefik (cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*) is an HTTP reverse proxy and load balancer that uses the headerField configuration parameter to inject authentication-related headers into upstream requests. The vulnerability manifests as a CWE-290 (Authentication Bypass by Spoofing) issue stemming from improper HTTP header canonicalization handling. When administrators configure non-canonical header names (e.g., x-auth-user in lowercase), Traefik writes the header in that form. However, HTTP header names are case-insensitive per RFC 7230, and many backend systems normalize headers to canonical form (e.g., X-Auth-User). An authenticated attacker with request injection capabilities can submit a request with the canonical version of the target header; since HTTP allows multiple header instances with the same name, the backend's header parsing logic reads the attacker-injected canonical header first, overriding Traefik's non-canonical write and enabling arbitrary identity assumption.
Know when Traefik gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.42, 3.6.11, and 3.7.0-ea.3, when headerField is configured with a non-canonical HTTP header name (e.g., x-auth-user instead of X-Auth-User), an authenticated attacker can inject their own canonical version of that header to impersonate any identity to the backend. The backend receives two header entries - the attacker-injected canonical one is read first, overriding Traefik's non-canonical write. Versions 2.11.42, 3.6.11, and 3.7.0-ea.3 patch the issue.
Executive ViewAI
Organizations using Traefik should be aware of moderate risk from CVE-2026-33433 rated CVSS 5.1. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Authentication bypass in Traefik reverse proxy before v2.11.55 lets remote unauthenticated attackers defeat any route pr
Backend connection hijacking in Traefik reverse proxy (2.11.0 through 2.11.56 and 3.0.0 through 3.7.12) lets an unauthen
HTTP/1 request-target parsing in Traefik prior to 2.11.57 and 3.7.13 allows unauthenticated remote attackers to send a r
Authentication bypass in the Traefik reverse proxy (v2.11.51 and earlier, v3.6.0-v3.6.22, and v3.7.0-v3.7.6) allows unau
Route-level authentication bypass in Traefik v3.7.0-v3.7.7 allows unauthenticated remote attackers to reach backend endp
Traefik is an open source HTTP reverse proxy and load balancer. Rated high severity (CVSS 7.5), this vulnerability is re
types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable
Security middleware bypass in Traefik reverse proxy versions 2.11.26-2.11.56 and 3.4.2-3.7.12 allows unauthenticated net
Traefik's header-security defenses (aliasHeadersStrategy, underscoreHeadersStrategy, forwardedHeaders) inspect req.Heade
Path normalization bypass in Traefik allows unauthenticated remote attackers to circumvent the middleware chain on path-
Traefik is an open source HTTP reverse proxy and load balancer. Rated medium severity (CVSS 6.5), this vulnerability is
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Exploit-DB