Log in Start free

Vulnerability · Published Sep 21, 2026 · Assigned by GitHub_M

CVE-2026-62987Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

Medium 5.8

In plain English

A medium-severity authentication bypass by spoofing in fabio from fabiolb. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.8Medium
Exploit odds (30 days)0.2%top 89.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/http_headers.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In proxy/http_proxy.go, HTTPProxy.ServeHTTP calls addHeaders to set these trust headers before Go ReverseProxy processes the inbound Connection header, allowing an unauthenticated client to name and remove the configured headers before the request reaches the backend. Deployments that enable the corresponding proxy.header options can therefore lose client-IP, TLS-termination, or request-correlation signals used by backend authorization and auditing; the options are empty by default, and the hardcoded protected forwarded headers are unaffected. This issue is fixed in version 1.7.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/fabiolb/fabio1.7.2GHSA-fq95-v8xc-jm3v
Gogithub.com/fabiolb/fabio1.7.2GO-2026-6566
Ubuntu:22.04:LTSconsulno fix listedUBUNTU-CVE-2026-62987

Affected products (as reported)

VendorProductVersions
fabiolb fabio >= 1.6.6, < 1.7.2

Weakness: CWE-290, CWE-348 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

References