CVE-2026-39858: Traefik auth bypass in ForwardAuth middleware via header spoofing

CVE-2026-39858 · Severity: critical · CVSS 10 · Published 2026-04-30

Traefik is a popular open-source tool used to manage and route web traffic to different services. A security flaw in how it handles web request headers allows attackers to bypass authentication checks on protected routes. This could allow an unauthorized person to access sensitive internal data or administrative functions without providing a valid password or credentials.

Technologies: github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go). Vendors: Go.

Quick answers

Is CVE-2026-39858 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-39858 being exploited in the wild.
How severe is CVE-2026-39858?
Critical severity, with a CVSS score of 10, published 30 April 2026.
Which products and versions are affected?
github.com/traefik/traefik (Go) SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.7.34; github.com/traefik/traefik/v2 (Go) SEMVER:introduced=0,fixed=2.11.43; github.com/traefik/traefik/v3 (Go) SEMVER:introduced=3.0.0-beta1,fixed=3.6.14,introduced=3.7.0-ea.1,fixed=3.7.0-rc.2, SEMVER:introduced=3.7.0-ea.1,fixed=3.7.0-rc.2.
Is there a fix for CVE-2026-39858?
Yes. github.com/traefik/traefik/v2 (Go): upgrade to 2.11.43 or later; github.com/traefik/traefik/v3 (Go): upgrade to 3.7.0-rc.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39858 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-39858?
Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go) or github.com/traefik/traefik/v3 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/traefik/traefik/v2 (Go): upgrade to 2.11.43 or later
    go get github.com/traefik/traefik/v2@v2.11.43
  • github.com/traefik/traefik/v3 (Go): upgrade to 3.7.0-rc.2 or later
    go get github.com/traefik/traefik/v3@v3.7.0-rc.2

Technical details

An authentication bypass vulnerability exists in Traefik's ForwardAuth and snippet-based authentication middleware due to inconsistent header sanitization. Traefik's sanitization logic only targets canonical header names (using dashes, e.g., X-Forwarded-Proto) and fails to strip or normalize alias variants using underscores (e.g., X_Forwarded_Proto). If an authentication backend normalizes these underscore-based headers, an unauthenticated remote attacker can inject spoofed trust context, such as a trusted host or protocol scheme. This allows the attacker to bypass authentication on protected routes. The issue is patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.

Affected products

  • Traefik Labs Traefik < 2.11.43, >= 3.0.0-beta1, < 3.6.14, >= 3.7.0-ea.1, < 3.7.0-rc.2

Identifiers

  • CVE-2026-39858
  • GHSA-5m6w-wvh7-57vm
  • GO-2026-5149

Timeline

  • 2026-04-22: patched: Fixes released in versions 2.11.43, 3.6.14, and 3.7.0-rc.2
  • 2026-04-24: advisory: GitHub Security Advisory GHSA-5m6w-wvh7-57vm published
  • 2026-04-30: disclosed: CVE-2026-39858 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.