fabiolb Fabio up to 1.7.1 Header Protection proxy/http_headers.go HTTPProxy.ServeHTTP improper authorization

Summaryinfo

A vulnerability categorized as problematic has been discovered in fabiolb Fabio up to 1.7.1. This impacts the function HTTPProxy.ServeHTTP of the file proxy/http_headers.go of the component Header Protection. Such manipulation leads to improper authorization. This vulnerability is traded as CVE-2026-62987. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in fabiolb Fabio up to 1.7.1 and classified as problematic. Affected by this issue is the function HTTPProxy.ServeHTTP of the file proxy/http_headers.go of the component Header Protection. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is integrity. CVE summarizes:

Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/http_headers.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In proxy/http_proxy.go, HTTPProxy.ServeHTTP calls addHeaders to set these trust headers before Go ReverseProxy processes the inbound Connection header, allowing an unauthenticated client to name and remove the configured headers before the request reaches the backend. Deployments that enable the corresponding proxy.header options can therefore lose client-IP, TLS-termination, or request-correlation signals used by backend authorization and auditing; the options are empty by default, and the hardcoded protected forwarded headers are unaffected. This issue is fixed in version 1.7.2.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-62987 since 07/15/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1548.002.

Upgrading to version 1.7.2 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• fabiolb

Name

• Fabio

Version

• 1.7.0
• 1.7.1

Website

• Product: https://github.com/fabiolb/fabio/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion