Executive brief
Fabio is a reverse proxy that forwards requests to backend services. It can be configured to inject operator-defined headers (like X-Client-IP, X-Request-ID, X-Secure) to signal trusted information to backends. However, an incomplete security fix allows unauthenticated clients to strip these headers from requests before they reach the backend, potentially bypassing IP-based access controls, downgrading TLS signals, or dropping request tracking—all without authentication.
Technical details
This vulnerability is an incomplete fix for CVE-2025-48865. The root cause is that Fabio's hop-by-hop header protection allowlist (`protectHeaders`) only covers 7 X-Forwarded-* headers, but does not include three operator-configured trust headers: ClientIPHeader, TLSHeader, and RequestID. An attacker can craft a malicious `Connection` header that lists these three headers; when Go's httputil.ReverseProxy processes the request, it removes any headers listed in the `Connection` header (a hop-by-hop mechanism), stripping the trust signals that Fabio injected. The vulnerability requires no authentication and is network-reachable. An attacker can bypass IP-based ACLs, downgrade TLS-terminated requests, or disrupt request correlation. The fix is to add the configured header names to the allowlist before the Connection header sweep occurs.
Affected products
- Fabio Fabio 1.6.6 through 1.7.1
Timeline
- 2026-09-22: disclosed: Advisory published