CVE-2026-39858: Traefik Authentication Bypass via Forwarded Alias Spoofing
Summary
CVE-2026-39858: Traefik: Pre-authentication decision bypass due to forwarded alias spoofing. Affects github.com/traefik/traefik/v3 across 2 version ranges.
>= 3.0.0-beta1, < 3.6.14
>= 3.7.0-ea.1, < 3.7.0-rc.2
Fixed in 3.6.14 or 3.7.0-rc.2, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2026-39858 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Traefik is an open-source edge router that manages the traffic between clients and backend services. It provides features such as load balancing, SSL termination, and dynamic configuration. Traefik's authentication middleware, particularly the ForwardAuth and snippet-based authentication, is designed to secure access to protected routes. However, it is vulnerable to an authentication bypass due to improper handling of forwarded headers.
Vulnerability Detail
The vulnerability arises from a flaw in Traefik's sanitization logic for forwarded headers. It only targets canonical header names (e.g., X-Forwarded-Proto) and fails to normalize or strip alias variants that use underscores (e.g., X_Forwarded_Proto). This allows attackers to inject spoofed trust context into the authentication backend, potentially bypassing authentication checks on protected routes. The issue is compounded by the backend's normalization of header names, treating both forms equivalently, which can lead to unauthorized access.
How To Fix
Latest published version: v3.7.16 as of 22 Oct 2026
go get github.com/traefik/traefik/v3@v3.7.16Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.0.0-beta1, < 3.6.143.6.14go get github.com/traefik/traefik/v3@v3.6.14 -
>= 3.7.0-ea.1, < 3.7.0-rc.23.7.0-rc.2go get github.com/traefik/traefik/v3@v3.7.0-rc.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can restrict the headers forwarded to the authentication service by implementing an explicit allowlist for headers, ensuring that only trusted headers are processed.
Conclusion
CVE-2026-39858 is a critical vulnerability in Traefik that can lead to unauthorized access through authentication bypass. It is essential to update to the latest patched versions to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for github.com/traefik/traefik/v3 →
FAQ
CVE-2026-39858 is a high-severity vulnerability in Traefik that allows attackers to bypass authentication by exploiting improper handling of forwarded headers.
If your application uses Traefik for authentication, this vulnerability could allow unauthorized users to access protected resources without valid credentials.
Affected versions include all versions prior to v2.11.43 for v2 and prior to v3.6.14 for v3.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
If immediate updating is not possible, implement a workaround by restricting forwarded headers to only those that are explicitly trusted.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/traefik/traefik/v3.
