CVE-2026-29054 Details
Description
Traefik is an HTTP reverse proxy and load balancer. From version 2.11.9 to 2.11.37 and from version 3.1.3 to 3.6.8, there is a potential vulnerability in Traefik managing the Connection header with X-Forwarded headers. When Traefik processes HTTP/1.1 requests, the protection put in place to prevent the removal of Traefik-managed X-Forwarded headers (such as X-Real-Ip, X-Forwarded-Host, X-Forwarded-Port, etc.) via the Connection header does not handle case sensitivity correctly. The Connection tokens are compared case-sensitively against the protected header names, but the actual header deletion operates case-insensitively. As a result, a remote unauthenticated client can use lowercase Connection tokens (e.g. Connection: x-real-ip) to bypass the protection and trigger the removal of Traefik-managed forwarded identity headers. This issue has been patched in versions 2.11.38 and 3.6.9.
A vulnerability exists in Traefik, an HTTP reverse proxy and load balancer, in versions 2.11.9 prior to 2.11.37 and 3.1.3 prior to 3.6.8. The issue arises in how Traefik manages the Connection header in relation to X-Forwarded headers. When processing HTTP/1.1 requests, Traefik's safeguards designed to prevent the removal of X-Forwarded headers it manages (such as X-Real-Ip, X-Forwarded-Host, and X-Forwarded-Port) through the Connection header fail to correctly account for case sensitivity. This flaw allows a remote unauthenticated client to use lowercase Connection tokens to bypass the protection and remove Traefik-managed forwarded identity headers. This vulnerability exploits a case-sensitive comparison that incorrectly aligns with the case-insensitive deletion process, leading to potential impacts on downstream services that rely on these headers for critical functions like authentication, authorization, routing, or scheme decisions.
Users can upgrade to Traefik versions 2.11.38 or 3.6.9 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:10175 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-29054 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2444872 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29054.json | redhat-SADP | |
| https://github.com/traefik/traefik/releases/tag/v2.11.38 | [email protected] | ProductRelease Notes |
| https://github.com/traefik/traefik/releases/tag/v3.6.9 | [email protected] | ProductRelease Notes |
| https://github.com/traefik/traefik/security/advisories/GHSA-92mv-8f8w-wq52 | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-178 | Improper Handling of Case Sensitivity | redhat-SADP |
| CWE-178 | Improper Handling of Case Sensitivity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| traefik traefik | >= 2.11.9, < 2.11.38 >= 3.1.3, < 3.6.9 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 6, 2026 | Initial Analysis | [email protected] |
| Mar 5, 2026 | New CVE Received | [email protected] |