# CVE-2026-54763: Traefik Proxy authentication bypass via underscore header spoofing

Source: https://junglewise.ai/threats/cve-2026-54763-traefik-proxy-authentication-bypass-via-underscore-header  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-06. Updated: 2026-08-06  
License: CC BY 4.0 with a link back

CVE-2026-54763 · Severity: high · CVSS 4 · Published 2026-07-06

Traefik, a popular open-source edge router and load balancer, contains a vulnerability in how it handles security headers during authentication. An attacker can bypass security controls by using headers containing underscores (like X_Auth_User) which Traefik fails to properly strip before forwarding requests to backend servers. This could allow an unauthorized user to spoof their identity or gain access to protected data and operations without valid credentials.

Technologies: [github.com/traefik/traefik (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik), [github.com/traefik/traefik/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2), [github.com/traefik/traefik/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v3), [Traefik Labs Traefik Proxy](https://junglewise.ai/threats/technologies/traefik-proxy). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Traefik Labs](https://junglewise.ai/threats/vendors/traefik-labs).

## Quick answers

**Is CVE-2026-54763 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54763 being exploited in the wild.

**How severe is CVE-2026-54763?** High severity, with a CVSS score of 4, published 6 July 2026.

**Which products and versions are affected?** github.com/traefik/traefik (Go) SEMVER:introduced=0; github.com/traefik/traefik/v2 (Go) SEMVER:introduced=0,fixed=2.11.51; github.com/traefik/traefik/v3 (Go) SEMVER:introduced=0,fixed=3.6.22, SEMVER:introduced=0,fixed=3.6.22,introduced=3.7.0,fixed=3.7.6; Traefik Labs Traefik Proxy < 2.11.51, >= 3.0.0-beta1 < 3.6.22, >= 3.7.0-ea.1 < 3.7.6, <= 3.6.21, >= 3.7.0, <= 3.7.5.

**Is there a fix for CVE-2026-54763?** Yes. github.com/traefik/traefik/v2 (Go): upgrade to 2.11.51 or later; github.com/traefik/traefik/v3 (Go): upgrade to 3.6.22, 3.7.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54763 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54763?** Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/traefik/traefik/v2 (Go): upgrade to 2.11.51 or later

  ```sh
  go get github.com/traefik/traefik/v2@v2.11.51
  ```

- github.com/traefik/traefik/v3 (Go): upgrade to 3.6.22, 3.7.6 or later

  ```sh
  go get github.com/traefik/traefik/v3@v3.7.6
  ```


## Technical details

A vulnerability exists in Traefik's authentication middlewares (BasicAuth, DigestAuth, and ForwardAuth) due to an incomplete fix for previous header spoofing issues. While Traefik strips canonical-cased headers (e.g., X-Auth-User), it does not account for underscore variants (e.g., X_Auth_User). Many backend environments (CGI, PHP, Nginx, Tomcat) normalize underscores to dashes or expose both, allowing an attacker to inject a spoofed identity header that reaches the backend alongside or instead of Traefik's intended value. In the ForwardAuth case, this can be exploited without valid credentials. The fix introduces a new 'allowHeadersWithUnderscores' option (defaulting to false) to strip these headers at the entry point.

## Affected products

- traefik traefik/v2 <= 2.11.50
- traefik traefik/v3 <= 3.6.21, >= 3.7.0, <= 3.7.5

## Identifiers

- CVE-2026-54763
- GHSA-x677-9fxg-v5c5
- GO-2026-6211

## Timeline

- 2026-07-01: patched: Initial patch release date for some versions
- 2026-08-06: advisory: GitHub Advisory published/updated

## References

- [https://api.github.com/users/matte1782](https://api.github.com/users/matte1782)
- [https://github.com/matte1782](https://github.com/matte1782)
- [https://api.github.com/users/matte1782/gists%7B/gist_id%7D](https://api.github.com/users/matte1782/gists%7B/gist_id%7D)
- [https://api.github.com/users/matte1782/repos](https://api.github.com/users/matte1782/repos)
- [https://avatars.githubusercontent.com/u/28739806?v=4](https://avatars.githubusercontent.com/u/28739806?v=4)
- [https://api.github.com/users/matte1782/events%7B/privacy%7D](https://api.github.com/users/matte1782/events%7B/privacy%7D)

## Related threats

- [Traefik BasicAuth singleflight username enumeration via timing oracle](https://junglewise.ai/threats/cve-2026-88010-traefik-basicauth-singleflight-username-enumeration-via-timing)
- [Traefik readTimeout not enforced on HTTP/3 connections](https://junglewise.ai/threats/cve-2026-88012-traefik-readtimeout-not-enforced-on-http-3-connections)
- [Traefik ForwardAuth identity spoofing via header alias](https://junglewise.ai/threats/cve-2026-88011-traefik-forwardauth-identity-spoofing-via-header-alias)
- [Traefik rootless HTTP/1 request-target routing bypass](https://junglewise.ai/threats/cve-2026-88009-traefik-rootless-http-1-request-target-routing-bypass)
- [Traefik HTTP request smuggling via unrestricted protocol upgrade](https://junglewise.ai/threats/cve-2026-88008-traefik-http-request-smuggling-via-unrestricted-protocol-upgrade)