Log in Start free

Vulnerability · Published Sep 10, 2026 · Assigned by GitHub_M

CVE-2026-88011Traefik: ForwardAuth identity spoofing via dot-form header alias

Medium 5.3

In plain English

A medium-severity authentication bypass by spoofing in traefik from traefik. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.3Medium
Exploit odds (30 days)0.4%top 63.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User while normalization-prone CGI, WSGI, PHP, and NGINX backends collapse both names. A backend can consequently consume the client value instead of the identity Traefik asserted, allowing identity spoofing for any header managed by Traefik. The aliasHeadersStrategy protection is disabled by default and must be configured as delete or reject. The mitigation is available in 2.11.56 and 3.7.12.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/traefik/traefikno fix listedGO-2026-6455
Gogithub.com/traefik/traefik/v22.11.56GHSA-rf44-j88r-hh8c
Gogithub.com/traefik/traefik/v22.11.56GO-2026-6455
Gogithub.com/traefik/traefik/v33.7.12GHSA-rf44-j88r-hh8c
Gogithub.com/traefik/traefik/v33.7.12GO-2026-6455

Affected products (as reported)

VendorProductVersions
traefik traefik < 2.11.56>= 3.0.0, < 3.7.12

Weakness: CWE-290 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

References