CVE-2026-54763: Traefik Identity Spoofing Vulnerability in BasicAuth and ForwardAuth
Summary
CVE-2026-54763: There is a high severity vulnerability in Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares. Affects github.com/traefik/traefik/v2 versions < 2.11.51. Fixed in 2.11.51. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Traefik is an open-source edge router that helps manage and route traffic to various services. It provides functionalities such as load balancing, SSL termination, and authentication through middlewares like BasicAuth, DigestAuth, and ForwardAuth. These middlewares are designed to secure access to protected routes by validating user credentials. However, a recent vulnerability has been identified that affects the integrity of these authentication mechanisms, allowing potential identity spoofing.
Vulnerability Detail
The vulnerability arises from an incomplete fix for previous issues (CVE-2026-33433 and CVE-2026-39858) related to header handling in Traefik. Specifically, the BasicAuth, DigestAuth, and ForwardAuth middlewares fail to properly handle underscore-variant headers (e.g., X_Auth_User) that can be injected by an attacker. This oversight allows an attacker to spoof identity or authorization context, as these headers can bypass Traefik's intended value setting and reach the backend services. The ramifications of this vulnerability are significant, as it can lead to unauthorized access and manipulation of sensitive data.
How To Fix
Latest published version: v2.11.60 as of 22 Oct 2026
go get github.com/traefik/traefik/v2@v2.11.60Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.11.51
This is the first release that contains the fix.
go get github.com/traefik/traefik/v2@v2.11.51Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can configure Traefik to strip headers with underscores by setting the following option in your entry point configuration:
entryPoints:
web:
address: ':80'
allowHeadersWithUnderscores: false
This configuration will prevent underscore-variant headers from being processed, reducing the risk of identity spoofing until you can apply the patch.
Conclusion
The CVE-2026-54763 vulnerability in Traefik poses a significant risk due to its potential for identity spoofing through improperly handled headers. It is crucial for users to update to the latest patched versions to secure their applications. Additionally, implementing the suggested workaround can help mitigate risks until the update is applied.
See every vulnerability recorded for github.com/traefik/traefik/v2 →
FAQ
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
Affected versions include Traefik v3.6.x up to 3.6.21, v3.7.x up to 3.7.5, and v2.11.x up to 2.11.50.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The vulnerability can lead to unauthorized access and manipulation of sensitive data, as attackers can spoof identity or authorization context.
Yes, you can configure Traefik to strip headers with underscores by setting 'allowHeadersWithUnderscores: false' in your entry point configuration.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/traefik/traefik/v2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
