Executive brief
Traefik is a popular cloud-native application proxy used to route and secure web traffic. A vulnerability in its authentication middleware allows attackers to trick the system into believing a request arrived on a secure port (like HTTPS port 443) when it actually arrived over an unencrypted connection. This can be used to bypass security rules in downstream applications that rely on port information to grant access to sensitive data or administrative functions.
Technical details
A vulnerability exists in Traefik's ForwardAuth middleware where the 'X-Forwarded-Port' header is derived from the original, untrusted request instead of the sanitized forwarded request, even when 'trustForwardHeader' is set to false. Specifically, the 'forwardedPort()' helper function reads the attacker-controlled 'X-Forwarded-Proto' header from the original request to determine the port. An unauthenticated remote attacker can send a plain HTTP request with 'X-Forwarded-Proto: https', causing Traefik to forward 'X-Forwarded-Port: 443' to the authentication service. This allows for the bypass of authorization logic in downstream services that gate access based on the perceived port. This issue is a regression of a previous fix (GHSA-6384-m2mw-rf54) that failed to address the port header. Patches are available in versions 2.11.51, 3.6.22, and 3.7.6.
Affected products
- Traefik traefik/traefik/v2 <= 2.11.50
- Traefik traefik/traefik/v3 <= 3.6.21, >= 3.7.0, <= 3.7.5
- Traefik traefik/traefik <= 1.7.34
Timeline
- 2026-07-01: disclosed: Initial disclosure to vendor
- 2026-07-06: advisory: NVD publication date
- 2026-08-06: patched: GitHub Advisory reviewed and updated with patch versions