EUVD-2026-41940
GHSA-x677-9fxg-v5c5
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Case sensitivity handling
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 06, 2026
Identity/authorization header spoofing in Traefik reverse proxy (before v2.11.51, v3.6.22, and v3.7.6) lets an attacker reaching a protected route smuggle an underscore-variant HTTP header past the BasicAuth, DigestAuth, and ForwardAuth middlewares' sanitization. Traefik strips canonical dashed spoofed headers before setting its own trusted value but ignores underscore forms (e.g. X_Forwarded_User vs X-Forwarded-User) that many backends normalize identically, so the forged header reaches the backend alongside — or, on the ForwardAuth authResponseHeaders path, instead of — Traefik's intended value. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but a vendor fix and upstream commit are published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Traefik gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares strip canonical-cased spoofed identity headers before writing Traefik's own value, but do not account for underscore-variant header names, which many backends normalize identically to dashed forms. An attacker able to reach a protected route can inject an underscore-variant header that survives Traefik's stripping and reaches the backend alongside, or on the unauthenticated ForwardAuth authResponseHeaders path instead of, the value Traefik intended to set, spoofing identity or authorization context. This issue is fixed in versions v2.11.51, v3.6.22, and v3.7.6.
Executive ViewAI
Traefik reverse proxy in versions prior to 2.11.51, 3.6.22, and 3.7.6 is vulnerable to authentication bypass attacks via header spoofing, allowing unauthorized access to protected backend applications. This affects all organizations using Traefik with BasicAuth, DigestAuth, or ForwardAuth middleware protections. Immediate patching is essential to maintain application access controls.
Within 24 hours: Identify all Traefik instances in your environment and document their versions and authentication middleware configuration. Within 7 days: Upgrade all instances to Traefik v2.11.51 (v2.x branch), v3.6.22 (v3.6.x branch), or v3.7.6 (v3.7.x branch), with thorough testing in staging before production rollout. Within 30 days: Validate all upgrades are complete; review authentication and access logs for suspicious activity patterns; conduct post-remediation security validation.
Apply vendor patch: Traefik v2.11.51 (v2.x), v3.6.22 (v3.6.x), or v3.7.6 (v3.7.x). Interim mitigations: Configure WAF or load balancer to block underscore-variant header formats (X_Forwarded_User, etc.); restrict network access to Traefik; enhance authentication event logging and anomaly detection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Authentication bypass in Traefik reverse proxy before v2.11.55 lets remote unauthenticated attackers defeat any route pr
Backend connection hijacking in Traefik reverse proxy (2.11.0 through 2.11.56 and 3.0.0 through 3.7.12) lets an unauthen
HTTP/1 request-target parsing in Traefik prior to 2.11.57 and 3.7.13 allows unauthenticated remote attackers to send a r
Authentication bypass in the Traefik reverse proxy (v2.11.51 and earlier, v3.6.0-v3.6.22, and v3.7.0-v3.7.6) allows unau
Route-level authentication bypass in Traefik v3.7.0-v3.7.7 allows unauthenticated remote attackers to reach backend endp
Traefik is an open source HTTP reverse proxy and load balancer. Rated high severity (CVSS 7.5), this vulnerability is re
types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable
Security middleware bypass in Traefik reverse proxy versions 2.11.26-2.11.56 and 3.4.2-3.7.12 allows unauthenticated net
Traefik's header-security defenses (aliasHeadersStrategy, underscoreHeadersStrategy, forwardedHeaders) inspect req.Heade
Path normalization bypass in Traefik allows unauthenticated remote attackers to circumvent the middleware chain on path-
Traefik is an open source HTTP reverse proxy and load balancer. Rated medium severity (CVSS 6.5), this vulnerability is
Same weakness CWE-178 – Improper Handling of Case Sensitivity
View allSame technique Code Injection
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Exploit-DB