Summary
generated automatically from NVD dataTraefik's ForwardAuth and snippet-based authentication middleware has an authentication bypass: its forwarded-header sanitization handles only canonical names such as X-Forwarded-Proto, so underscore variants like X_Forwarded_Proto pass unchanged to the authentication backend. If that backend treats underscores and dashes as equivalent, an attacker can spoof trusted context such as scheme or host and reach protected routes without valid credentials. The issue is rated CRITICAL with a CVSS score of 10.0 and is patched in 2.11.43, 3.6.14, and 3.7.0-rc.2.
NVD description
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's ForwardAuth and snippet-based authentication middleware. Traefik's forwarded-header sanitization logic targets only canonical header names (e.g., X-Forwarded-Proto) and does not strip or normalize alias variants that use underscores instead of dashes (e.g., X_Forwarded_Proto). These unsanitized alias headers are forwarded intact to the authentication backend. When the backend normalizes underscore and dash header forms equivalently, an attacker can inject spoofed trust context — such as a trusted scheme or host — through the alias headers and bypass authentication on protected routes without valid credentials. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.
EPSS · FIRST.org
0.60%probability of exploitation in the next 30 days
Higher than 47% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 30 avr. 2026
- Updated
- 15 juil. 2026
- Status
- Modified
- Source
- security-advisories@github.com
Affected products
Weaknesses (CWE)
References (8)
- https://github.com/traefik/traefik/releases/tag/v2.11.43ProductRelease Notes
- https://github.com/traefik/traefik/releases/tag/v3.6.14ProductRelease Notes
- https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2ProductRelease Notes
- https://github.com/traefik/traefik/security/advisories/GHSA-5m6w-wvh7-57vmExploitMitigationPatchVendor Advisory
Similar CVEs
Other vulnerabilities of type CWE-290
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.