CVE-2026-29054: Traefik case-sensitivity bypass in Connection header allows removal of X-Forwarded headers

CVE-2026-29054 · Severity: high · CVSS 7.5 · Published 2026-03-05

Traefik, a popular tool used to route and manage web traffic, contains a flaw in how it handles security headers that identify the origin of a request. An attacker can trick the system into stripping away these identity headers, such as the user's real IP address. This can allow unauthorized users to bypass security rules or access controls that rely on knowing where a request actually came from.

Technologies: github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go), Traefik Labs Traefik Proxy. Vendors: Go, Traefik Labs.

Quick answers

Is CVE-2026-29054 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-29054 being exploited in the wild.
How severe is CVE-2026-29054?
High severity, with a CVSS score of 7.5, published 5 March 2026.
Which products and versions are affected?
github.com/traefik/traefik (Go) SEMVER:introduced=0; github.com/traefik/traefik/v2 (Go) SEMVER:introduced=2.11.9,fixed=2.11.38; github.com/traefik/traefik/v3 (Go) SEMVER:introduced=3.1.3,fixed=3.6.9; Traefik Labs Traefik Proxy >= 2.11.9, < 2.11.38; >= 3.1.3, < 3.6.9.
Is there a fix for CVE-2026-29054?
Yes. github.com/traefik/traefik/v2 (Go): upgrade to 2.11.38 or later; github.com/traefik/traefik/v3 (Go): upgrade to 3.6.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-29054 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-29054?
Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/traefik/traefik/v2 (Go): upgrade to 2.11.38 or later
    go get github.com/traefik/traefik/v2@v2.11.38
  • github.com/traefik/traefik/v3 (Go): upgrade to 3.6.9 or later
    go get github.com/traefik/traefik/v3@v3.6.9

Technical details

A vulnerability exists in Traefik's XForwarded middleware (specifically the removeConnectionHeaders function) due to improper handling of case sensitivity. While Traefik attempts to protect internal headers like X-Real-Ip and X-Forwarded-* from being manipulated via the HTTP/1.1 Connection header, it performs a case-sensitive membership check against a list of protected headers while the subsequent deletion is case-insensitive. A remote unauthenticated attacker can send a request with lowercase tokens in the Connection header (e.g., 'Connection: x-real-ip') to bypass the protection and force Traefik to strip its own managed identity headers. This can lead to an authentication or authorization bypass if downstream services rely on these headers for IP allowlisting or trust decisions. The issue is a bypass of the fix for CVE-2024-45410 and has been patched in versions 2.11.38 and 3.6.9.

Affected products

  • Traefik Proxy Traefik >= 2.11.9, < 2.11.38; >= 3.1.3, < 3.6.9
  • Red Hat Red Hat OpenShift Dev Spaces 3.27 3.27.1

Identifiers

  • CVE-2026-29054
  • GHSA-92mv-8f8w-wq52
  • GO-2026-4597

Timeline

  • 2026-03-04: advisory: GitHub Security Advisory GHSA-92mv-8f8w-wq52 published
  • 2026-03-05: disclosed: CVE-2026-29054 published to NVD
  • 2026-04-23: patched: Red Hat released security advisory RHSA-2026:10175

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.