Executive brief
Traefik, a popular open-source edge router and load balancer, contains a vulnerability in how it handles security headers during authentication. An attacker can bypass security controls by using headers containing underscores (like X_Auth_User) which Traefik fails to properly strip before forwarding requests to backend servers. This could allow an unauthorized user to spoof their identity or gain access to protected data and operations without valid credentials.
Technical details
A vulnerability exists in Traefik's authentication middlewares (BasicAuth, DigestAuth, and ForwardAuth) due to an incomplete fix for previous header spoofing issues. While Traefik strips canonical-cased headers (e.g., X-Auth-User), it does not account for underscore variants (e.g., X_Auth_User). Many backend environments (CGI, PHP, Nginx, Tomcat) normalize underscores to dashes or expose both, allowing an attacker to inject a spoofed identity header that reaches the backend alongside or instead of Traefik's intended value. In the ForwardAuth case, this can be exploited without valid credentials. The fix introduces a new 'allowHeadersWithUnderscores' option (defaulting to false) to strip these headers at the entry point.
Affected products
- traefik traefik/v2 <= 2.11.50
- traefik traefik/v3 <= 3.6.21, >= 3.7.0, <= 3.7.5
Timeline
- 2026-07-01: patched: Initial patch release date for some versions
- 2026-08-06: advisory: GitHub Advisory published/updated