CVE-2026-29054: Traefik Vulnerability Allows Header Manipulation via Case-Insensitive Connection Tokens
Summary
CVE-2026-29054: Impact There is a potential vulnerability in Traefik managing the Connection header with X-Forwarded headers. Affects github.com/traefik/traefik/v2 versions >= 2.11.9, < 2.11.38. Fixed in 2.11.38. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Traefik is an open-source reverse proxy and load balancer designed to manage microservices and APIs. It automatically routes incoming requests to the appropriate backend services based on defined rules. Traefik supports various protocols and integrates seamlessly with container orchestration platforms. However, it has a vulnerability that affects how it handles the 'Connection' header, potentially allowing unauthorized clients to manipulate forwarded identity headers.
Vulnerability Detail
The vulnerability arises from Traefik's handling of the 'Connection' header when processing HTTP/1.1 requests. Specifically, the protection mechanism that prevents the removal of Traefik-managed 'X-Forwarded' headers (like 'X-Real-Ip') is case-sensitive, while the actual deletion process is case-insensitive. This discrepancy allows a remote unauthenticated client to send lowercase 'Connection' tokens (e.g., 'Connection: x-real-ip') to bypass the protection and delete critical identity headers. The implications of this vulnerability can be severe, especially if downstream services rely on these headers for authentication and authorization, leading to potential access control bypass.
How To Fix
Latest published version: v2.11.60 as of 22 Oct 2026
go get github.com/traefik/traefik/v2@v2.11.60Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.11.38
This is the first release that contains the fix.
go get github.com/traefik/traefik/v2@v2.11.38Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no workarounds available for this vulnerability. It is strongly recommended to update to the patched versions as soon as possible.
Conclusion
In summary, CVE-2026-29054 is a critical vulnerability in Traefik that allows unauthorized clients to manipulate important identity headers due to case sensitivity in the 'Connection' header. It is crucial to update to the patched versions to mitigate this risk.
See every vulnerability recorded for github.com/traefik/traefik/v2 →
FAQ
CVE-2026-29054 is a vulnerability in Traefik that allows unauthorized clients to manipulate forwarded identity headers by exploiting case sensitivity in the 'Connection' header.
If your application relies on Traefik-managed headers for authentication or routing, this vulnerability could allow unauthorized access or manipulation of requests.
Traefik versions prior to v2.11.38 and v3.6.9 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/traefik/traefik/v2.
