CVE-2026-54764: Traefik Proxy authorization bypass in ForwardAuth middleware

CVE-2026-54764 · Severity: medium · CVSS 5.8 · Published 2026-07-06

Traefik is a popular cloud-native application proxy used to route and secure web traffic. A vulnerability in its authentication middleware allows attackers to trick the system into believing a request arrived on a secure port (like HTTPS port 443) when it actually arrived over an unencrypted connection. This can be used to bypass security rules in downstream applications that rely on port information to grant access to sensitive data or administrative functions.

Technologies: github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go), Traefik Labs Traefik Proxy. Vendors: Go, Traefik Labs.

Quick answers

Is CVE-2026-54764 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54764 being exploited in the wild.
How severe is CVE-2026-54764?
Medium severity, with a CVSS score of 5.8, published 6 July 2026.
Which products and versions are affected?
github.com/traefik/traefik (Go) SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.7.34; github.com/traefik/traefik/v2 (Go) SEMVER:introduced=0,fixed=2.11.51; github.com/traefik/traefik/v3 (Go) SEMVER:introduced=0,fixed=3.6.22, SEMVER:introduced=0,fixed=3.6.22,introduced=3.7.0,fixed=3.7.6; Traefik Labs Traefik Proxy < 2.11.51, >= 3.0.0 < 3.6.22, >= 3.7.0 < 3.7.6.
Is there a fix for CVE-2026-54764?
Yes. github.com/traefik/traefik/v2 (Go): upgrade to 2.11.51 or later; github.com/traefik/traefik/v3 (Go): upgrade to 3.6.22, 3.7.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54764 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54764?
Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/traefik/traefik/v2 (Go): upgrade to 2.11.51 or later
    go get github.com/traefik/traefik/v2@v2.11.51
  • github.com/traefik/traefik/v3 (Go): upgrade to 3.6.22, 3.7.6 or later
    go get github.com/traefik/traefik/v3@v3.7.6

Technical details

A vulnerability exists in Traefik's ForwardAuth middleware where the 'X-Forwarded-Port' header is derived from the original, untrusted request instead of the sanitized forwarded request, even when 'trustForwardHeader' is set to false. Specifically, the 'forwardedPort()' helper function reads the attacker-controlled 'X-Forwarded-Proto' header from the original request to determine the port. An unauthenticated remote attacker can send a plain HTTP request with 'X-Forwarded-Proto: https', causing Traefik to forward 'X-Forwarded-Port: 443' to the authentication service. This allows for the bypass of authorization logic in downstream services that gate access based on the perceived port. This issue is a regression of a previous fix (GHSA-6384-m2mw-rf54) that failed to address the port header. Patches are available in versions 2.11.51, 3.6.22, and 3.7.6.

Affected products

  • Traefik traefik/traefik/v2 <= 2.11.50
  • Traefik traefik/traefik/v3 <= 3.6.21, >= 3.7.0, <= 3.7.5
  • Traefik traefik/traefik <= 1.7.34

Identifiers

  • CVE-2026-54764
  • GHSA-3q9r-p662-5j8m
  • GO-2026-6202

Timeline

  • 2026-07-01: disclosed: Initial disclosure to vendor
  • 2026-07-06: advisory: NVD publication date
  • 2026-08-06: patched: GitHub Advisory reviewed and updated with patch versions

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.