Executive brief
Traefik is a reverse proxy that provides built-in protections to prevent clients from spoofing trusted security headers used for authentication and access control. A flaw in Traefik v3 allows attackers to bypass these protections by smuggling forged headers through a secondary HTTP channel (request trailers). When certain middleware components buffer request bodies, attackers can inject forged identity headers with attacker-chosen values that reach backend services, potentially enabling account takeover, privilege escalation, or IP-based access bypass in downstream systems that rely on these headers.
Technical details
The vulnerability is a header-name sanitization bypass in Traefik v3's custom reverse proxy (`pkg/proxy/httputil`). All entrypoint sanitization handlers—`removeAliasingHeaders`, `rejectAliasingHeaders`, `removeHeadersWithUnderscores`, `rejectHeadersWithUnderscores`, and `DeleteXForwardedHeaders`—iterate only `req.Header` and ignore `req.Trailer`, despite doc comments claiming coverage of both. Unauthenticated clients can declare HTTP trailers containing aliasing names (e.g., `X_Auth_User`) or trusted names (e.g., `X-Forwarded-Prefix`). Go's HTTP server pre-fills trailer names in `req.Trailer` before the handler runs, making them invisible to entrypoint checks. On bare proxy paths, trailer values are dropped (limiting impact to name-level); however, when body-buffering middleware (retry with `status` codes or the `buffering` middleware) reads the body first, trailer values are populated before the proxy clone, allowing attacker-controlled values to reach the backend. Backends that merge trailers into header namespaces (e.g., pre-fix libevent per CVE-2026-63379) then trust and act on the smuggled headers for authorization decisions. Traefik v2 is unaffected because it uses Go's standard-library `httputil.ReverseProxy`, which does not forward request trailer values. The fix stops forwarding request trailer values to backends while preserving trailer names as permitted by RFC 9110 §6.6.2.
Affected products
- Traefik Traefik v3.2.0 through v3.7.12
Timeline
- 2026-09-07: disclosed
- 2026-09-10: advisory
- 2026-09-10: patched: Traefik v3.7.13 released with fix; v3.2–v3.6 end-of-life, users must upgrade to v3.7.13