CVE-2026-88011
Received Received - Intake

HTTP Header Spoofing in Traefik Reverse Proxy

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description
Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User while normalization-prone CGI, WSGI, PHP, and NGINX backends collapse both names. A backend can consequently consume the client value instead of the identity Traefik asserted, allowing identity spoofing for any header managed by Traefik. The aliasHeadersStrategy protection is disabled by default and must be configured as delete or reject. The mitigation is available in 2.11.56 and 3.7.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88011
EUVD
EUVD-2026-75584

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
traefik traefik to 2.11.56 (exc)
traefik traefik From 3.0.0 (inc) to 3.7.12 (inc)
traefik traefik to 3.7.12 (inc)
traefik traefik 2.11.56
traefik traefik 3.7.12
traefik traefik 2.11.51
traefik traefik 2.11.55

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Traefik versions before 2.11.56 and from 3.0.0 to 3.7.12 have a header spoofing vulnerability. Go treats header names like X.Authenticated.User and X-Authenticated-User as distinct, but backends like CGI, WSGI, PHP, and NGINX normalize them to the same variable. Attackers can send a spoofed header that Traefik's ForwardAuth sets, causing the backend to read the attacker-controlled value instead of the authenticated identity.

The aliasHeadersStrategy option was introduced to mitigate this by handling all header name variations. It can be set to keep (default), delete, or reject headers with aliasing characters. The old underscoreHeadersStrategy only addressed underscores and is now deprecated.

Detection Guidance

Check Traefik version with 'traefik version' or 'docker inspect <traefik-container> | grep TRAEFIK_VERSION'. If using v2.11.55 or below or v3.0.0 to v3.7.11, the system is vulnerable. Inspect Traefik logs for 'underscoreHeadersStrategy' warnings or missing 'aliasHeadersStrategy' configuration.

Impact Analysis

An attacker with low privileges could impersonate higher-privileged users by sending a spoofed header. This could lead to unauthorized access, privilege escalation, or data breaches if the backend processes the spoofed identity instead of the authenticated one set by Traefik's ForwardAuth.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating confidentiality and integrity requirements in GDPR and HIPAA. Unpatched systems may fail compliance audits due to insufficient access controls and potential exposure of sensitive data.

Mitigation Strategies

Upgrade Traefik to v2.11.56 or v3.7.12 or later. Configure 'aliasHeadersStrategy' to 'delete' or 'reject' in static config (YAML/TOML), CLI flags, or env vars. Disable 'underscoreHeadersStrategy' if present. Restart Traefik after changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88011. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart