CVE-2026-62987 in Fabio
Summary
by MITRE • 09/21/2026
Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/http_headers.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In proxy/http_proxy.go, HTTPProxy.ServeHTTP calls addHeaders to set these trust headers before Go ReverseProxy processes the inbound Connection header, allowing an unauthenticated client to name and remove the configured headers before the request reaches the backend. Deployments that enable the corresponding proxy.header options can therefore lose client-IP, TLS-termination, or request-correlation signals used by backend authorization and auditing; the options are empty by default, and the hardcoded protected forwarded headers are unaffected. This issue is fixed in version 1.7.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified as CVE-2025-48865 resides within Fabio, an HTTP and TCP router designed for deploying applications managed by Consul. Specifically affecting versions from 1.6.6 through 1.7.2 prior to the application of a specific security patch, this flaw stems from an incomplete implementation of header protection logic in the proxy's source code. The core issue lies in the file proxy/http_headers.go where the function protectHeaders was intended to safeguard critical forwarding headers against manipulation by downstream clients or intermediate proxies. However, the fix implemented during these versions failed to include three specific configuration-dependent headers: ClientIPHeader, TLSHeader, and RequestID. While a hardcoded set of forwarded headers remained protected, the omission of these dynamically configured header names created a significant gap in the security boundary between the router and backend services.
The technical mechanism of exploitation involves the sequence of operations within proxy/http_proxy.go during the HTTPProxy.ServeHTTP process. When an inbound request arrives, the system is designed to add trust headers that indicate client identity, TLS termination status, and unique request identifiers before passing the request to Go's ReverseProxy component for further processing toward backend servers. Due to the aforementioned omission in protectHeaders, unauthenticated clients can manipulate or remove these specific configured headers prior to their application by the reverse proxy logic. This allows a malicious actor to inject false values into fields such as X-Forwarded-For or strip out TLS and request correlation metadata entirely before the traffic reaches the backend infrastructure.
The operational impact of this vulnerability is severe for deployments that have explicitly enabled the corresponding proxy.header options, which are disabled by default in standard configurations. When these features are active, backend services rely on the integrity of client IP addresses for access control, TLS termination indicators for security policy enforcement, and request IDs for auditing and distributed tracing. By allowing an unauthenticated user to spoof or remove these signals, attackers can bypass authorization mechanisms that depend on trusted source IPs, obscure the origin of malicious traffic making forensic analysis difficult, and disrupt correlation logs essential for monitoring system health and detecting anomalies. This effectively undermines the security posture provided by the router layer, exposing backend applications to unauthorized access and reducing visibility into attack patterns.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation as it involves failing to properly validate or protect input data that influences critical security decisions. It also relates to CWE-749 Exposure of Sensitive Information to an Unauthorized Actor if the manipulation leads to unauthorized access based on spoofed headers. In terms of adversary tactics, this flaw facilitates techniques associated with MITRE ATT&CK T1078 Valid Accounts or more broadly T1136 Create Account depending on how backend systems interpret the manipulated client IP data for session management and authentication bypasses. The vulnerability essentially allows a form of header injection that subverts trust boundaries established by infrastructure components.
Mitigation strategies primarily involve upgrading to version 1.7.2 where this specific logical error in protectHeaders has been corrected to include all operator-configured headers alongside the hardcoded set. For environments unable to upgrade immediately, administrators should ensure that proxy.header options for ClientIPHeader, TLSHeader, and RequestID remain disabled or empty if they are not strictly required by backend applications. Additionally implementing strict input validation at the application layer rather than relying solely on infrastructure-level header trust can provide defense in depth. Monitoring logs for anomalies in client IP distributions or missing correlation IDs may also help detect exploitation attempts while patching efforts proceed.