CVE-2026-88879
Awaiting Analysis Awaiting Analysis - Queue

Header Canonicalization Bypass in Traefik

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so X-Auth-User, X_Auth_User and X.Auth.User are treated as three distinct headers by Traefik, while backends that derive variable names from header names (CGI, WSGI, PHP, NGINX and others) collapse them into a single variable. A client can therefore smuggle a dot-form alias of a header that Traefik manages past the middleware managing it — for example supplying X.Authenticated.User alongside the canonical X-Authenticated-User written by the ForwardAuth middleware — causing such a backend to read the client-supplied value instead of the identity Traefik asserted. In the tested configuration (PHP 8.2 built-in SAPI over an HTTP/1 backend path), Go's lexical header ordering makes the attacker-supplied value win deterministically, so a client that ForwardAuth admits as a low-privilege identity can be treated by the backend as a different user or role. Any header Traefik sets is affected, not only ForwardAuth's. This is an incomplete fix for GHSA-x677-9fxg-v5c5, which blocked only the underscore form. Fixed in v2.11.56 and v3.7.12, which add the aliasHeadersStrategy entry-point option; because it defaults to 'keep' for backwards compatibility, it must be explicitly set to 'delete' or 'reject' for the fix to take effect. Unmaintained release lines will not receive a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88879
EUVD
EUVD-2026-75429

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
traefik traefik to 2.11.56|end_excluding=3.7.12 (exc)
traefik traefik From 3.0.0 (inc) to 3.7.12 (exc)
traefik traefik to 2.11.56 (exc)
traefik traefik to 3.7.12 (exc)
traefik traefik 1.x
traefik traefik 2.x

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Traefik is vulnerable to identity spoofing via header alias manipulation. Header names are only canonicalized on dashes, so variations like X-Auth-User, X_Auth_User, and X.Auth.User are treated as distinct by Traefik but collapsed into one by backends such as PHP or NGINX. Attackers can smuggle an alternative header alias past Traefik's middleware, bypassing authentication checks. For example, X.Authenticated.User can be sent alongside X-Authenticated-User set by ForwardAuth, causing the backend to use the attacker-controlled value instead of the authenticated identity.

Detection Guidance

Check Traefik version with 'traefik version' command. If using versions v2.x below 2.11.56 or v3.x below 3.7.12, the system is vulnerable. Inspect Traefik configuration for 'aliasHeadersStrategy' setting. Monitor HTTP headers for variations like X-Auth-User, X_Auth_User, and X.Auth.User being processed by backends.

Impact Analysis

This vulnerability allows an attacker with low privileges to impersonate another user or role by sending a crafted header. For instance, a low-privilege user could be treated as an admin by the backend, leading to unauthorized access or privilege escalation. Confidentiality and integrity of data may be compromised as the backend processes spoofed headers.

Compliance Impact

This vulnerability can lead to unauthorized access and data breaches, violating confidentiality and integrity requirements in GDPR and HIPAA. Non-compliance may result in legal penalties, reputational damage, and loss of trust. Organizations using vulnerable Traefik versions must upgrade or apply mitigations to maintain compliance.

Mitigation Strategies

Upgrade Traefik to v2.11.56 or v3.7.12 or later. Set 'aliasHeadersStrategy' to 'delete' or 'reject' in Traefik configuration. If upgrading is not possible, implement network-level controls to block malformed headers or restrict backend access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88879. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart