Vulnerability · Published Apr 30, 2026 · Assigned by GitHub_M

CVE-2026-39858Traefik: Forwarded alias spoofing top pre-auth decision bypass

High 8.2

In plain English

A high-severity authentication bypass by spoofing in traefik from traefik. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.5%top 58.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's ForwardAuth and snippet-based authentication middleware. Traefik's forwarded-header sanitization logic targets only canonical header names (e.g., X-Forwarded-Proto) and does not strip or normalize alias variants that use underscores instead of dashes (e.g., X_Forwarded_Proto). These unsanitized alias headers are forwarded intact to the authentication backend. When the backend normalizes underscore and dash header forms equivalently, an attacker can inject spoofed trust context — such as a trusted scheme or host — through the alias headers and bypass authentication on protected routes without valid credentials. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/traefik/traefik	no fix listed	GHSA-5m6w-wvh7-57vm
Go	github.com/traefik/traefik	no fix listed	GO-2026-5149
Go	github.com/traefik/traefik/v2	2.11.43	GHSA-5m6w-wvh7-57vm
Go	github.com/traefik/traefik/v2	2.11.43	GO-2026-5149
Go	github.com/traefik/traefik/v3	3.7.0-rc.2	GHSA-5m6w-wvh7-57vm
Go	github.com/traefik/traefik/v3	3.6.14, 3.7.0-rc.2	GO-2026-5149
Go	github.com/traefik/traefik/v3	3.6.14	GHSA-5m6w-wvh7-57vm

Affected products (as reported)

Vendor	Product	Versions
traefik	traefik	< 2.11.43>= 3.0.0-beta1, < 3.6.14>= 3.7.0-ea.1, < 3.7.0-rc.2

Weakness: CWE-290, CWE-306, CWE-289 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References

https://github.com/traefik/traefik/security/advisories/GHSA-5m6w-wvh7-57vm x_refsource_CONFIRM
https://github.com/traefik/traefik/releases/tag/v2.11.43 x_refsource_MISC
https://github.com/traefik/traefik/releases/tag/v3.6.14 x_refsource_MISC
https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2 x_refsource_MISC
https://access.redhat.com/security/cve/CVE-2026-39858 vdb-entry, x_refsource_REDHAT
RHBZ#2464234 issue-tracking, x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39858.json x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:21772 vendor-advisory, x_refsource_REDHAT