CVE-2026-62987 Details
Description
Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/http_headers.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In proxy/http_proxy.go, HTTPProxy.ServeHTTP calls addHeaders to set these trust headers before Go ReverseProxy processes the inbound Connection header, allowing an unauthenticated client to name and remove the configured headers before the request reaches the backend. Deployments that enable the corresponding proxy.header options can therefore lose client-IP, TLS-termination, or request-correlation signals used by backend authorization and auditing; the options are empty by default, and the hardcoded protected forwarded headers are unaffected. This issue is fixed in version 1.7.2.
A vulnerability exists in Fabio, an HTTP(S) and TCP router for applications managed by Consul, in versions 1.6.6 prior to 1.7.2. The issue arises because the fix for CVE-2025-48865 did not fully address header protection. While certain headers are safeguarded, the operator-configured ClientIPHeader, TLSHeader, and RequestID headers are left vulnerable. This allows an unauthenticated client to manipulate these headers before the request reaches the backend, potentially disrupting client-IP, TLS-termination, or request-correlation signals used for authorization and auditing. The vulnerability can be exploited by sending a request that removes or alters the specified headers, particularly when the corresponding proxy.header options are enabled.
Users can upgrade to Fabio version 1.7.2, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/fabiolb/fabio/security/advisories/GHSA-fq95-v8xc-jm3v | CISA-ADP | AdvisoryBundleRemedyVendor |
| https://github.com/fabiolb/fabio/commit/240526a8004077edad4fb96d25b382bfc3901357 | [email protected] | Source CodeVendor |
| https://github.com/fabiolb/fabio/releases/tag/v1.7.2 | [email protected] | Release NotesVendor |
| https://github.com/fabiolb/fabio/security/advisories/GHSA-fq95-v8xc-jm3v | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-290 | Authentication Bypass by Spoofing | [email protected] |
| CWE-348 | Use of Less Trusted Source | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| fabiolb fabio | >= 1.6.6, <= 1.7.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |