CVE-2026-33433 Details
Description
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.42, 3.6.11, and 3.7.0-ea.3, when `headerField` is configured with a non-canonical HTTP header name (e.g., `x-auth-user` instead of `X-Auth-User`), an authenticated attacker can inject their own canonical version of that header to impersonate any identity to the backend. The backend receives two header entries — the attacker-injected canonical one is read first, overriding Traefik's non-canonical write. Versions 2.11.42, 3.6.11, and 3.7.0-ea.3 patch the issue.
A vulnerability exists in Traefik's Basic and Digest authentication middlewares, prior to versions 2.11.42, 3.6.11, and 3.7.0-ea.3. When the 'headerField' is set with a non-canonical HTTP header name, an authenticated attacker can inject the canonical version of that header to impersonate any identity to the backend. This occurs because Traefik writes the header using a non-canonical key, creating a duplicate header entry. As a result, the backend reads the injected canonical header first, allowing the attacker to override the original value and control the identity being presented.
Users can upgrade to Traefik versions 2.11.42, 3.6.11, or 3.7.0-ea.3 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:10175 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-33433 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2452289 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33433.json | redhat-SADP | |
| https://github.com/traefik/traefik/releases/tag/v2.11.42 | [email protected] | ProductRelease Notes |
| https://github.com/traefik/traefik/releases/tag/v3.6.11 | [email protected] | ProductRelease Notes |
| https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.3 | [email protected] | ProductRelease Notes |
| https://github.com/traefik/traefik/security/advisories/GHSA-qr99-7898-vr7c | [email protected] | ExploitPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-290 | Authentication Bypass by Spoofing | redhat-SADP |
| CWE-290 | Authentication Bypass by Spoofing | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| traefik traefik | < 2.11.42 >= 3.0.0, < 3.6.12 3.7.0 ea1 3.7.0 ea2 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 3, 2026 | Initial Analysis | [email protected] |
| Mar 27, 2026 | New CVE Received | [email protected] |