CVE-2026-88879 in Traefik
Summary
by MITRE • 09/10/2026
Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so X-Auth-User, X_Auth_User and X.Auth.User are treated as three distinct headers by Traefik, while backends that derive variable names from header names (CGI, WSGI, PHP, NGINX and others) collapse them into a single variable. A client can therefore smuggle a dot-form alias of a header that Traefik manages past the middleware managing it — for example supplying X.Authenticated.User alongside the canonical X-Authenticated-User written by the ForwardAuth middleware — causing such a backend to read the client-supplied value instead of the identity Traefik asserted. In the tested configuration (PHP 8.2 built-in SAPI over an HTTP/1 backend path), Go's lexical header ordering makes the attacker-supplied value win deterministically, so a client that ForwardAuth admits as a low-privilege identity can be treated by the backend as a different user or role. Any header Traefik sets is affected, not only ForwardAuth's. This is an incomplete fix for GHSA-x677-9fxg-v5c5, which blocked only the underscore form. Fixed in v2.11.56 and v3.7.12, which add the aliasHeadersStrategy entry-point option; because it defaults to 'keep' for backwards compatibility, it must be explicitly set to 'delete' or 'reject' for the fix to take effect. Unmaintained release lines will not receive a patch.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
Traefik serves as an HTTP reverse proxy and load balancer widely used in modern containerized environments to manage traffic routing, security policies, and service discovery. A critical vulnerability exists within versions v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11 regarding the canonicalization of HTTP header names. The core technical flaw stems from an inconsistency in how Traefik processes incoming headers compared to how backend application servers interpret them. Specifically, Traefik only normalizes dashes into underscores or treats specific variations as distinct entities during its internal processing logic. Consequently, a client can submit multiple variants of the same logical header, such as X-Auth-User, X_Auth_User, and X.Auth.User, which Traefik perceives as three separate headers rather than duplicates of a single field.
This discrepancy creates a significant security gap because many backend technologies, including CGI, WSGI, PHP, NGINX, and others, follow different standards for header parsing that often collapse these variations into a single variable or prioritize specific formats like dot-notation. An attacker can exploit this by smuggling a dot-form alias of a managed header past Traefik’s middleware controls. For instance, if the ForwardAuth middleware is configured to validate authentication via X-Authenticated-User and sets it upon successful validation, an attacker can simultaneously supply X.Authenticated.User with arbitrary values. Since backend systems often merge these inputs or prioritize non-canonical forms depending on implementation details, the application may read the client-supplied value instead of the identity asserted by Traefik.
The operational impact is severe, as this flaw allows for authentication bypass and privilege escalation. In tested configurations involving PHP 8.2 built-in SAPI over an HTTP/1 backend path, Go’s lexical header ordering ensures that attacker-supplied values deterministically win over those set by the proxy. This means a client admitted as a low-privilege identity or unauthenticated user can be treated by the backend application as a different user with higher privileges or administrative roles. The vulnerability is not limited to ForwardAuth middleware; any header managed and modified by Traefik is susceptible to this manipulation, potentially affecting authorization checks, session management, and other security-critical logic embedded in HTTP headers.
This issue represents an incomplete fix for the previously disclosed GHSA-x677-9fxg-v5c5, which only addressed the underscore form of header aliases but neglected dot-form variations. The vulnerability aligns with CWE-20 Improper Input Validation and falls under MITRE ATT&CK techniques related to Request Smuggling or Header Injection, where an intermediary’s interpretation differs from a downstream component’s parsing logic. To mitigate this risk, administrators must upgrade to Traefik v2.11.56 or v3.7.12 or later. Crucially, these versions introduce the aliasHeadersStrategy entry-point option which defaults to keep for backward compatibility; therefore, explicit configuration is required to set this strategy to delete or reject. This ensures that duplicate header variants are either removed from the request before reaching the backend or cause the connection to be rejected entirely, thereby enforcing strict canonicalization and preventing identity spoofing through header manipulation. Unmaintained release lines will not receive patches, necessitating immediate migration for affected systems.