CVE-2026-54764: Traefik ForwardAuth Middleware X-Forwarded-Port Spoofing Vulnerability
Summary
CVE-2026-54764: There is a medium severity vulnerability in Traefik's ForwardAuth middleware. Affects github.com/traefik/traefik/v2 versions < 2.11.51. Fixed in 2.11.51. How to fix ↓
Also tracked for
The same CVE-2026-54764 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Traefik is a modern HTTP reverse proxy and load balancer that makes deploying microservices easy. It integrates with various backends and provides features like automatic HTTPS, routing, and middleware support. The ForwardAuth middleware is designed to handle authentication by forwarding requests to an external authentication service. However, a vulnerability exists in this middleware that allows attackers to manipulate headers, potentially bypassing security checks.
Vulnerability Detail
The vulnerability arises from the ForwardAuth middleware's handling of the X-Forwarded-Port header. Even with the trustForwardHeader setting disabled, Traefik derives the X-Forwarded-Port from the original request instead of the sanitized forwarded request. This allows an unauthenticated attacker to inject an X-Forwarded-Proto: https header over a plain HTTP connection, causing Traefik to forward X-Forwarded-Port: 443 to the authentication service. This can lead to privilege escalation by bypassing port-based authorization checks, as the authentication service may incorrectly grant access based on the spoofed header.
How To Fix
Latest published version: v2.11.60 as of 22 Oct 2026
go get github.com/traefik/traefik/v2@v2.11.60Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.11.51
This is the first release that contains the fix.
go get github.com/traefik/traefik/v2@v2.11.51Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can set up your authentication service to ignore the X-Forwarded-Port header or implement additional checks to validate the source of the request. However, this is not a long-term solution and updating to a patched version is strongly recommended.
Conclusion
The CVE-2026-54764 vulnerability in Traefik's ForwardAuth middleware poses a significant risk by allowing attackers to spoof headers and bypass security checks. It is crucial to update to the latest patched versions to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for github.com/traefik/traefik/v2 →
FAQ
CVE-2026-54764 is a vulnerability in Traefik's ForwardAuth middleware that allows attackers to spoof the X-Forwarded-Port header, potentially bypassing security checks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
An unauthenticated attacker can exploit this vulnerability to bypass port-based authorization checks, leading to unauthorized access to protected resources.
Versions of Traefik prior to v2.11.51, v3.6.22, and v3.7.6 are affected by this vulnerability.
If immediate updating is not possible, consider implementing a workaround by configuring your authentication service to ignore the X-Forwarded-Port header.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/traefik/traefik/v2.
