Log in Start free

Vulnerability · Published Mar 27, 2026 · Assigned by GitHub_M

CVE-2026-33433Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField

High 7.7

In plain English

A high-severity authentication bypass by spoofing in traefik from traefik. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.5%top 57.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.42, 3.6.11, and 3.7.0-ea.3, when `headerField` is configured with a non-canonical HTTP header name (e.g., `x-auth-user` instead of `X-Auth-User`), an authenticated attacker can inject their own canonical version of that header to impersonate any identity to the backend. The backend receives two header entries — the attacker-injected canonical one is read first, overriding Traefik's non-canonical write. Versions 2.11.42, 3.6.11, and 3.7.0-ea.3 patch the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/traefik/traefikno fix listedGO-2026-4893
Gogithub.com/traefik/traefik/v22.11.42GHSA-qr99-7898-vr7c
Gogithub.com/traefik/traefik/v22.11.42GO-2026-4893
Gogithub.com/traefik/traefik/v33.6.12GHSA-qr99-7898-vr7c
Gogithub.com/traefik/traefik/v33.7.0-ea.3GHSA-qr99-7898-vr7c
Gogithub.com/traefik/traefik/v33.6.12, 3.7.0-ea.3GO-2026-4893

Affected products (as reported)

VendorProductVersions
traefik traefik < 2.11.42>= 3.0.0-beta1, < 3.6.11>= 3.7.0-ea.1, < 3.7.0-ea.3

Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

References