CVE-2026-54763 Details
Description
Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares strip canonical-cased spoofed identity headers before writing Traefik's own value, but do not account for underscore-variant header names, which many backends normalize identically to dashed forms. An attacker able to reach a protected route can inject an underscore-variant header that survives Traefik's stripping and reaches the backend alongside, or on the unauthenticated ForwardAuth authResponseHeaders path instead of, the value Traefik intended to set, spoofing identity or authorization context. This issue is fixed in versions v2.11.51, v3.6.22, and v3.7.6.
A vulnerability exists in Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares, prior to versions v2.11.51, v3.6.22, and v3.7.6. The issue arises because these middlewares strip canonical-cased spoofed identity headers, such as 'X-Auth-User', before setting Traefik's own value. However, they do not consider underscore-variant header names, which many backends normalize to the same as dashed forms. This oversight allows an attacker to inject an underscore-variant header that bypasses Traefik's stripping process and reaches the backend, either alongside or instead of the intended value, thereby spoofing identity or authorization context.
Users can update to Traefik versions v2.11.51, v3.6.22, or v3.7.6. For those using v2.11.51 or later, the 'underscoreHeadersStrategy' option can be set to 'delete' or 'reject' on entry points that front backends interpreting underscores and dashes in header names the same way.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-178 | Improper Handling of Case Sensitivity | [email protected] |
| CWE-290 | Authentication Bypass by Spoofing | [email protected] |
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| traefik traefik | < 2.11.51 >= 3.0.0, < 3.6.22 >= 3.7.0, < 3.7.6 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | Initial Analysis | [email protected] |
| Jul 7, 2026 | CVE Modified | [email protected] |
| Jul 6, 2026 | New CVE Received | [email protected] |